CVE-2024-35312

Executive Summary

CVE-2024-35312 is a vulnerability in the Tor Arti implementation, specifically affecting the STUB circuit construction when "lite vanguards" are enabled. The flaw causes STUB circuits to be created with a fixed length of 2, rather than the intended longer path. This reduces the anonymity set and makes it easier for an adversary to perform traffic correlation attacks, potentially deanonymizing users. The vulnerability is tracked as TROVE-2024-003. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the Rust-based Tor Arti library, which is distributed via the Rust crate registry (crates.io). Users and developers who depend on the arti crate should verify their dependency version and update to 1.2.3 or later. The supply chain risk is moderate, as the vulnerable code is in a core anonymity library.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that no official CVSS vector has been assigned by the NVD. However, based on the technical impact, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited by an adversary observing network traffic.
• Attack Complexity (AC): Low (L) – Exploitation requires only passive observation of circuit construction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the Tor Arti library itself.
• Confidentiality (C): High (H) – Anonymity is compromised, potentially revealing user identities.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability directly undermines the core anonymity guarantee of Tor.

Deep Dive & Mechanics

Tor Arti is a Rust implementation of the Tor protocol. It supports "vanguards," a feature that adds extra hops to circuits to protect against traffic confirmation attacks. "Lite vanguards" are a simplified version of this feature.

The vulnerability lies in the circuit path selection logic for STUB circuits. STUB circuits are short-lived circuits used for specific purposes like fetching directory information. When lite vanguards are enabled, the code incorrectly forces the STUB circuit length to exactly 2 hops (guard + exit), bypassing the intended vanguard layer. This makes the circuit structurally identical to a non-vanguard circuit, negating the protection.

The root cause is a logic error in the circuit builder where the vanguard layer is not applied to STUB circuits. The fix ensures that STUB circuits also include the vanguard hop when lite vanguards are enabled.

Vulnerable vs. Patched Code

The vulnerable code is in the circuit path selection module. The following is a simplified representation:

Vulnerable (before 1.2.3):

fn build_stub_circuit_path() -> Vec<RelayId> {
    let guard = select_guard();
    let exit = select_exit();
    // BUG: No vanguard hop added for STUB circuits
    vec![guard, exit]
}

Patched (1.2.3 and later):

fn build_stub_circuit_path() -> Vec<RelayId> {
    let guard = select_guard();
    let vanguard = select_vanguard(); // Added
    let exit = select_exit();
    // FIX: Include vanguard hop for STUB circuits
    vec![guard, vanguard, exit]
}

The patch adds a call to select_vanguard() and includes the vanguard relay in the circuit path, ensuring the circuit length is 3 (guard + vanguard + exit) when lite vanguards are enabled.

Exploitation & Lab Setup

Red Team

No public exploit code exists. Exploitation would require an adversary to:

1. Operate a malicious Tor exit relay or guard relay.
2. Monitor circuit construction patterns.
3. Identify STUB circuits with length 2 (indicating the vulnerability).
4. Correlate traffic entering and exiting the circuit to deanonymize the user.

Lab Setup:

1. Deploy a Tor test network using chutney or tor-net.
2. Configure a vulnerable Arti client (version < 1.2.3) with lite_vanguards: true.
3. Run a traffic capture on the guard and exit relays.
4. Observe that STUB circuits have only 2 hops.

Blue Team

Detection:

• Monitor for STUB circuits with exactly 2 hops in Tor Arti logs.
• Look for anomalies in circuit length distribution.

Hunting:

• Query logs for circuit built events where circuit_type == STUB and hop_count == 2.
• Correlate with lite_vanguards configuration.

Mitigation:

• Immediately upgrade to Tor Arti 1.2.3 or later.
• If upgrade is not possible, disable lite vanguards as a temporary workaround.

Indicators of Compromise (IOCs)

• Log Pattern: STUB circuit built with 2 hops (vulnerable version)
• Log Pattern: STUB circuit built with 3 hops (patched version)
• Network: STUB circuits with exactly 2 relays in the path (guard + exit)
• Configuration: lite_vanguards: true in Arti config (vulnerable if version < 1.2.3)

Detection Engineering

YARA Rule

rule CVE_2024_35312_Tor_Arti_STUB_Circuit
{
    meta:
        description = "Detects vulnerable Tor Arti STUB circuit construction"
        author = "Valters IT"
        date = "2024-05-20"
        cve = "CVE-2024-35312"
    strings:
        $s1 = "STUB circuit built with 2 hops" nocase
        $s2 = "lite_vanguards" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2024-35312 - Tor Arti STUB Circuit Length Anomaly
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects STUB circuits with only 2 hops in Tor Arti logs, indicating CVE-2024-35312 exploitation.
author: Valters IT
date: 2024/05/20
logsource:
    product: tor
    service: arti
detection:
    selection:
        EventID: "circuit_built"
        CircuitType: "STUB"
        HopCount: 2
    condition: selection
falsepositives:
    - Non-vanguard configurations (intentional)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-35312 Tor Arti STUB Circuit Anomaly"; flow:to_server; content:"STUB circuit built with 2 hops"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Tor Arti to version 1.2.3 or later.
2. Workaround: If upgrade is not possible, disable lite vanguards by setting lite_vanguards: false in the Arti configuration.
3. Verification: After patching, verify that STUB circuits now have 3 hops (guard + vanguard + exit) in the logs.
4. Monitoring: Continue to monitor for any STUB circuits with only 2 hops as a sign of incomplete patching or re-exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-35312