- tor-commits - lists.torproject.org

[tor/release-0.2.1] Add a fix for the buf_pullup bug that Vektor reported
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9d0777839be6642954a4c064c819d406d8bb7cb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 16:38:43 2011 -0500 Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000..634f609 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7103746..5701604 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize;

1 0

[tor/release-0.2.1] Changelog and blurb for 0.2.1.32
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit aea35fbb1bae0a6451c1f07b5d09c766dd38ec42 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:38:00 2011 -0500 Changelog and blurb for 0.2.1.32 --- ChangeLog | 13 ++++++++++++- changes/buffer_bug | 7 ------- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3e75785..912a3d9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,10 +1,21 @@ -Changes in version 0.2.1.32 - 201?-??-?? +Changes in version 0.2.1.32 - 2011-12-16 + Tor 0.2.1.32 backports important security and privacy fixes for + oldstable. This release is intended only for package maintainers and + others who cannot use the 0.2.2 stable series. All others should be + using Tor 0.2.2.x or newer. + + The Tor 0.2.1.x series will reach formal end-of-life some time in + early 2012, when we will stop releasing patches for it. o Major bugfixes (also included in 0.2.2.x): - Correctly sanity-check that we don't underflow on a memory allocation (and then assert) for hidden service introduction point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; bugfix on 0.2.1.5-alpha. + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". o Minor features: - Update to the December 6 2011 Maxmind GeoLite Country database. diff --git a/changes/buffer_bug b/changes/buffer_bug deleted file mode 100644 index 634f609..0000000 --- a/changes/buffer_bug +++ /dev/null @@ -1,7 +0,0 @@ - - o Major bugfixes: - - Fix a heap overflow bug that could occur when trying to pull - data into the first chunk of a buffer, when that chunk had - already had some data drained from it. Fixes CVE-2011-2778; - bugfix on 0.2.0.16-alpha. Reported by "Vektor". -

1 0

[tor/release-0.2.1] Copy 0.2.1.32 changelog entry into releasenotes
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit fbfc8e032fb6fb6ba82583c09611caf491de66fd Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 13:17:05 2011 -0500 Copy 0.2.1.32 changelog entry into releasenotes --- ReleaseNotes | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-) diff --git a/ReleaseNotes b/ReleaseNotes index e3de631..6a538e5 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,29 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.1.32 - 2011-12-16 + Tor 0.2.1.32 backports important security and privacy fixes for + oldstable. This release is intended only for package maintainers and + others who cannot use the 0.2.2 stable series. All others should be + using Tor 0.2.2.x or newer. + + The Tor 0.2.1.x series will reach formal end-of-life some time in + early 2012, when we will stop releasing patches for it. + + o Major bugfixes (also included in 0.2.2.x): + - Correctly sanity-check that we don't underflow on a memory + allocation (and then assert) for hidden service introduction + point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; + bugfix on 0.2.1.5-alpha. + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + + o Minor features: + - Update to the December 6 2011 Maxmind GeoLite Country database. + + Changes in version 0.2.1.31 - 2011-10-26 Tor 0.2.1.31 backports important security and privacy fixes for oldstable. This release is intended only for package maintainers and

1 0

[tor/release-0.2.1] Merge branch 'maint-0.2.1' into release-0.2.1
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 03c7d9e992f250a484d4770af12271e742a3bd81 Merge: 5eff44c 9d07778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:35:23 2011 -0500 Merge branch 'maint-0.2.1' into release-0.2.1 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.1] Bump the version to 0.2.1.32
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit c30ac81d40e81d3d0136a83612a151d930d57b0c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 12:01:07 2011 -0500 Bump the version to 0.2.1.32 --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index f654361..202b2f5 100644 --- a/configure.in +++ b/configure.in @@ -5,7 +5,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.1.31) +AM_INIT_AUTOMAKE(tor, 0.2.1.32) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index efb3208..573510e 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -9,7 +9,7 @@ !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.1.31" +!define VERSION "0.2.1.32" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 12af228..6f3e218 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -226,6 +226,6 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.1.31" +#define VERSION "0.2.1.32"

1 0

[tor/release-0.2.2] Add a fix for the buf_pullup bug that Vektor reported
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9d0777839be6642954a4c064c819d406d8bb7cb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 16:38:43 2011 -0500 Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000..634f609 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7103746..5701604 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize;

1 0

[tor/release-0.2.1] Tweak changelog a little
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 887bddb7e7323334484c9651ae116e3d28e7b217 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 14:23:21 2011 -0500 Tweak changelog a little --- ChangeLog | 2 +- ReleaseNotes | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 912a3d9..8a8f7e9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,7 +5,7 @@ Changes in version 0.2.1.32 - 2011-12-16 using Tor 0.2.2.x or newer. The Tor 0.2.1.x series will reach formal end-of-life some time in - early 2012, when we will stop releasing patches for it. + early 2012; we will stop releasing patches for it then. o Major bugfixes (also included in 0.2.2.x): - Correctly sanity-check that we don't underflow on a memory diff --git a/ReleaseNotes b/ReleaseNotes index 6a538e5..f7a421d 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -10,7 +10,7 @@ Changes in version 0.2.1.32 - 2011-12-16 using Tor 0.2.2.x or newer. The Tor 0.2.1.x series will reach formal end-of-life some time in - early 2012, when we will stop releasing patches for it. + early 2012; we will stop releasing patches for it then. o Major bugfixes (also included in 0.2.2.x): - Correctly sanity-check that we don't underflow on a memory

1 0

[tor/release-0.2.2] Merge branch 'maint-0.2.2' into release-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 2c70ca0e944a086d03b92d978c957a5de90d00c8 Merge: ed46539 562c974 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:38:40 2011 -0500 Merge branch 'maint-0.2.2' into release-0.2.2 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 562c974ee7913b09bc1b19e4674dea618f2c6328 Merge: 0582746 9d07778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:28:44 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.2] Changelog for 0.2.2.35
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit d4b935e77f6675fab4e4efe91736a5f63c24e66b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:56:26 2011 -0500 Changelog for 0.2.2.35 --- ChangeLog | 24 ++++++++++++++++++++++-- changes/buffer_bug | 7 ------- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index a8f677b..e1bc545 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,23 @@ -Changes in version 0.2.2.35 - 2011-12-1? - - Tor 0.2.2.35 fixes several bugs in previous versions, including +Changes in version 0.2.2.35 - 2011-12-16 + Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's + buffers code. Absolutely everybody should upgrade. + + The bug relied on an incorrect calculation when making data continuous + in one of our IO buffers, if the first chunk of the buffer was + misaligned by just the wrong amount. The miscalculation would allow an + attacker to overflow a piece of heap-allocated memory. To mount this + attack, the attacker would need to either open a SOCKS connection to + Tor's SocksPort (usually restricted to localhost), or target a Tor + instance configured to make its connections through a SOCKS proxy + (which Tor does not do by default). + + Good security practice requires that all heap-overflow bugs should be + presumed to be exploitable until proven otherwise, so we are treating + this as a potential code execution attack. Please upgrade immediately! + This bug does not affect bufferevents-based builds of Tor. Special + thanks to "Vektor" for reporting this issue to us! + + Tor 0.2.2.35 also fixes several bugs in previous versions, including crash bugs for unusual configurations, and a long-term bug that would that would prevent Tor from starting on Windows machines with draconian AV software. @@ -11,6 +28,9 @@ Changes in version 0.2.2.35 - 2011-12-1? 0.2.2.x series. If you're using a Linux or BSD and its packages are obsolete, stop using those packages and upgrade anyway. + The Tor 0.2.1.x series is also approaching its end-of-life: it will no + longer receive support after some time in early 2011. + o Major bugfixes: - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so that it doesn't attempt to allocate a socketpair. This could cause diff --git a/changes/buffer_bug b/changes/buffer_bug deleted file mode 100644 index 634f609..0000000 --- a/changes/buffer_bug +++ /dev/null @@ -1,7 +0,0 @@ - - o Major bugfixes: - - Fix a heap overflow bug that could occur when trying to pull - data into the first chunk of a buffer, when that chunk had - already had some data drained from it. Fixes CVE-2011-2778; - bugfix on 0.2.0.16-alpha. Reported by "Vektor". -

1 0