CVE-2024-35313

Executive Summary

CVE-2024-35313 is a security advisory affecting Tor Arti, a Rust implementation of the Tor anonymity protocol. The vulnerability, tracked as TROVE-2024-004, causes circuits to incorrectly have a length of 3 when full vanguards are enabled. This reduces the anonymity set and makes users more susceptible to traffic correlation attacks. The flaw exists in versions before 1.2.3. No public proof-of-concept (PoC) or exploit code is available at this time. The CVSS score is currently 0.0 due to incomplete NVD data, but the actual impact is high as it undermines the core anonymity guarantees of the Tor network.

Supply Chain & Package Security

This vulnerability is in the Tor Arti Rust crate, which is distributed via crates.io and GitHub. Users should verify the integrity of the package using checksums provided by the Tor Project. The patch is available in version 1.2.3, and no known supply chain attacks have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

The NVD has not yet assigned a CVSS score, but based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Anonymity is compromised.
• Integrity (I): High (H) – Circuit path integrity is broken.
• Availability (A): High (H) – Anonymity service is degraded.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Threat Level: Critical (9.8)

Deep Dive & Mechanics

Tor Arti implements the Tor protocol in Rust. The "vanguards" feature adds additional guard nodes to protect against traffic confirmation attacks. In a properly configured vanguard setup, circuits should have a length of 4 (entry guard, middle, vanguard, exit). Due to a logic error in the circuit path selection algorithm, circuits are built with only 3 hops when full vanguards are enabled. This effectively removes one layer of anonymity, making it easier for an adversary to correlate traffic between the client and destination.

The bug is in the circuit path building code, specifically in the function that determines the number of hops. When vanguards are enabled, the code incorrectly calculates the required length, resulting in a 3-hop circuit instead of 4. This reduces the anonymity set and increases the risk of deanonymization.

Vulnerable vs. Patched Code

Vulnerable (before 1.2.3):

// Simplified vulnerable logic
fn circuit_length(vanguards_enabled: bool) -> usize {
    if vanguards_enabled {
        3 // Incorrect: should be 4
    } else {
        3
    }
}

Patched (1.2.3):

// Corrected logic
fn circuit_length(vanguards_enabled: bool) -> usize {
    if vanguards_enabled {
        4 // Correct: full vanguards require 4 hops
    } else {
        3
    }
}

The patch ensures that when full vanguards are enabled, the circuit length is set to 4, restoring the intended anonymity protection.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the vulnerability in a lab:

1. Set up a Tor Arti instance with version < 1.2.3.
2. Enable full vanguards in the configuration.
3. Monitor circuit creation logs to observe 3-hop circuits.
4. Use traffic analysis tools to demonstrate reduced anonymity.

Blue Team

To detect exploitation:

1. Monitor Tor Arti logs for circuit length anomalies.
2. Use network monitoring to identify 3-hop circuits from clients that should have 4-hop circuits.
3. Implement alerts for unexpected circuit patterns.

Indicators of Compromise (IOCs)

• Network: Tor circuits with only 3 hops when vanguards are enabled.
• Logs: Arti log entries showing circuit length of 3 instead of 4.
• Configuration: vanguards.enabled = true with version < 1.2.3.

Detection Engineering

YARA Rule

rule CVE_2024_35313_Tor_Arti_Vanguard_Circuit_Length {
    meta:
        description = "Detects Tor Arti versions vulnerable to CVE-2024-35313"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-35313"
    strings:
        $version_string = "arti v" ascii wide nocase
        $vanguard_config = "vanguards" ascii wide nocase
    condition:
        $version_string and $vanguard_config
}

Sigma Rule

title: Tor Arti Circuit Length Anomaly
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects Tor Arti circuits with incorrect length (3 hops when vanguards enabled)
logsource:
    product: tor
    service: arti
detection:
    selection:
        event: "circuit_created"
        circuit_length: 3
        vanguards_enabled: true
    condition: selection
falsepositives:
    - Legitimate 3-hop circuits when vanguards are disabled
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-35313 Tor Arti Vanguard Circuit Length Anomaly"; flow:to_server; content:"|00 03|"; depth:2; offset:0; reference:cve,2024-35313; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Tor Arti version 1.2.3 or later.
2. Workaround: Disable full vanguards if upgrade is not possible (set vanguards.enabled = false).
3. Monitoring: Enable detailed circuit logging and monitor for 3-hop circuits.
4. Validation: Verify circuit lengths using arti status commands.

Valters IT
DevSecOps & Cyber Threat Intelligence