March 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.4] Disable the dump_desc() function.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit ede88c374cd61e1e362422718625707a770cffff Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 19 12:31:19 2021 -0500 Disable the dump_desc() function. It can be called with strings that should have been length-delimited, but which in fact are not. This can cause a CPU-DoS bug or, in a worse case, a crash. Since this function isn't essential, the best solution for older Tors is to just turn it off. Fixes bug 40286; bugfix on 0.2.2.1-alpha when dump_desc() was introduced. --- changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal new file mode 100644 index 0000000000..b8669debaa --- /dev/null +++ b/changes/ticket40286_minimal @@ -0,0 +1,5 @@ + o Major bugfixes (denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. + Fixes bug 40286; bugfix on 0.2.2.1-alpha. diff --git a/src/feature/dirparse/unparseable.c b/src/feature/dirparse/unparseable.c index 941b5a1f6d..a547335452 100644 --- a/src/feature/dirparse/unparseable.c +++ b/src/feature/dirparse/unparseable.c @@ -492,6 +492,12 @@ dump_desc,(const char *desc, const char *type)) { tor_assert(desc); tor_assert(type); +#ifndef TOR_UNIT_TESTS + /* On older versions of Tor we are disabling this function, since it + * can be called with strings that are far too long. */ + if (1) + return; +#endif size_t len; /* The SHA256 of the string */ uint8_t digest_sha256[DIGEST256_LEN];

1 0

[tor/release-0.4.4] Merge branch 'bug40286_disable_min_035' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f46f4562cf6f47fe6c00752f61b04dc18a454253 Merge: 1a0b5fd569 ede88c374c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:41:03 2021 -0400 Merge branch 'bug40286_disable_min_035' into maint-0.3.5 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 8ada4263a95b2a5bc6ef6022664aadca14039d97 Merge: 9f59b6f458 1a0b5fd569 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:40:06 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 "ours" to avoid version bump.

1 0

[tor/release-0.4.4] Bump to 0.3.5.14
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 1a0b5fd569684fc2d75436f7b3befcc5652c87e1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:39:45 2021 -0400 Bump to 0.3.5.14 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 44f96b6616..af3762d460 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.13-dev]) +AC_INIT([tor],[0.3.5.14]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index a4ddf8b46c..1f3f728aa0 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.5.13-dev" +!define VERSION "0.3.5.14" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 991369b9f9..9cab6cf3e3 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.5.13-dev" +#define VERSION "0.3.5.14"

1 0

[tor/release-0.3.5] Copy 0.3.5.14 changelog to releasenotes
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 50d4300e77ea2f8f7d17aade1b9f32f38cffbcde Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 08:30:27 2021 -0400 Copy 0.3.5.14 changelog to releasenotes --- ReleaseNotes | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index a833379509..6a2e8fc7a8 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,54 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.3.5.14 - 2021-03-16 + Tor 0.3.5.14 backports fixes for two important denial-of-service bugs + in earlier versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a + compatibility issue. + + o Major bugfixes (security, denial of service, backport from 0.4.5.7): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data, backport from 0.4.5.7): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing terms, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Removed features (mallinfo deprecated, backport from 0.4.5.7): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.3.5.13 - 2020-02-03 Tor 0.3.5.13 backports numerous bugfixes from later releases, including one that made v3 onion services more susceptible to

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit ecf1ba974621f954368a3d3d0232b8094a15e745 Merge: b3c891119c 5ec579610a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit c63e09043a357c2bf39f37433baa18b365309869 Merge: 1a407612bc fb2c889a38 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:42:55 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 2eb900f7e2ca64e6ce16fc86410cafd935e7cd1e Merge: b9f6539008 efca9ce41c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:54:00 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-)

1 0

[tor/release-0.4.4] Bump to 0.4.4.8
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit fb2c889a388e85ca808e30106fd8a8194ed72f07 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:40:48 2021 -0400 Bump to 0.4.4.8 --- configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/configure.ac b/configure.ac index db5bfee202..731fb29f28 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.4.4.7-dev]) +AC_INIT([tor],[0.4.4.8]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) @@ -16,7 +16,7 @@ configure_flags="$*" # version number changes. Tor uses it to make sure that it # only shuts down for missing "required protocols" when those protocols # are listed as required by a consensus after this date. -AC_DEFINE(APPROX_RELEASE_DATE, ["2021-02-03"], # for 0.4.4.7-dev +AC_DEFINE(APPROX_RELEASE_DATE, ["2021-03-15"], # for 0.4.4.8 [Approximate date when this software was released. (Updated when the version changes.)]) # "foreign" means we don't follow GNU package layout standards diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 39b7999fd1..06a204fe5b 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.4.4.7-dev" +!define VERSION "0.4.4.8" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index d1d60bffa2..b7e1cdff48 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -217,7 +217,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.4.4.7-dev" +#define VERSION "0.4.4.8" #define HAVE_STRUCT_SOCKADDR_IN6 #define HAVE_STRUCT_IN6_ADDR

1 0

[tor/release-0.4.4] Clarify new intended strategy with TROVE-2021-001
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit efca9ce41c96bb0044f504ced36a2734b1689ee2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:53:36 2021 -0400 Clarify new intended strategy with TROVE-2021-001 We're going to disable this feature in all versions for now. --- changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal index b8669debaa..6a04ca79eb 100644 --- a/changes/ticket40286_minimal +++ b/changes/ticket40286_minimal @@ -1,5 +1,6 @@ - o Major bugfixes (denial of service): + o Major bugfixes (security, denial of service): - Disable the dump_desc() function that we used to dump unparseable information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. - Fixes bug 40286; bugfix on 0.2.2.1-alpha. + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as + TROVE-2021-001 and CVE-2021-28089. diff --git a/src/feature/dirparse/unparseable.c b/src/feature/dirparse/unparseable.c index a547335452..1d623fe701 100644 --- a/src/feature/dirparse/unparseable.c +++ b/src/feature/dirparse/unparseable.c @@ -493,8 +493,11 @@ dump_desc,(const char *desc, const char *type)) tor_assert(desc); tor_assert(type); #ifndef TOR_UNIT_TESTS - /* On older versions of Tor we are disabling this function, since it - * can be called with strings that are far too long. */ + /* For now, we are disabling this function, since it can be called with + * strings that are far too long. We can turn it back on if we fix it + * someday, but we'd need to give it a length argument. A likelier + * resolution here is simply to remove this module entirely. See tor#40286 + * for background. */ if (1) return; #endif

1 0