Opened 11 months ago

Closed 9 months ago

Last modified 9 months ago

#25074 closed defect (fixed)

TROVE-2018-001: null-pointer crash in directory authority protocol list code

Reported by: teor Owned by: nickm
Priority: Medium Milestone: Tor: 0.3.3.x-final
Component: Core Tor/Tor Version:
Severity: Normal Keywords: 033-must, review-group-33
Cc: Actual Points:
Parent ID: Points:
Reviewer: catalyst Sponsor:

Description (last modified by nickm)

The subprotocol implementation in 0.2.9.4-alpha had a bug where an incorrectly formatted relay descriptor could cause directory servers to crash when they tried to vote about it. This does not affect relays or clients, since they do not try to vote.

Tracked as TROVE-2018-001 and CVE-2018-0490.

Child Tickets

Change History (9)

comment:1 Changed 10 months ago by dgoulet

Owner: set to nickm
Status: newassigned

comment:2 Changed 10 months ago by dgoulet

Keywords: 033-must added

Some ticket dgoulet thinks must go in 033.

comment:3 Changed 10 months ago by asn

Reviewer: review-group-33

comment:4 Changed 10 months ago by asn

Status: assignedneeds_review

comment:5 Changed 10 months ago by asn

Keywords: review-group-33 added
Reviewer: review-group-33

comment:6 Changed 10 months ago by catalyst

Reviewer: catalyst

comment:7 Changed 10 months ago by catalyst

Status: needs_reviewmerge_ready

Patches look ok to me, after manually resolving conflicts as teor suggested. Manually built and ran make check on what I hope are the same configurations as we have in Travis: Ubuntu 16.04 {gcc,clang}*{rust,no-rust}. (except for cargo-offline) These were on master because that's where i did the conflict resolution; if there's a need to check 0.3.3 separately I can do that too.

comment:8 Changed 9 months ago by nickm

Description: modified (diff)
Resolution: fixed
Status: merge_readyclosed
Summary: TROVE-2018-001TROVE-2018-001: null-pointer crash in directory authority protocol list code

comment:9 Changed 9 months ago by nickm

Fixed in 0.2.9.15, 0.3.1.10, 0.3.2.10, and 0.3.3.3-alpha.

Note: See TracTickets for help on using tickets.