CVE-2020-8516: 
NixOS vulnerability analysis and mitigation

The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. This vulnerability was discovered in February 2020 and is tracked as CVE-2020-8516. The Tor network team has stated this is intended behavior and not a vulnerability (Tor Dev List).

The vulnerability relates to how Tor handles rendezvous points in its circuit creation. When establishing connections, the Tor daemon does not validate whether a rendezvous node is part of the known Tor network consensus before attempting to connect to it. This allows attackers to specify arbitrary nodes as rendezvous points, even if they are not official Tor nodes, and observe which connections are attempted (HackerFactor Blog).

The vulnerability could allow attackers to map out parts of a Tor circuit and potentially identify guard nodes through a process of elimination. By repeatedly mapping the last relay node used by a service and analyzing which Tor node families are involved, attackers could narrow down the possible guard nodes. This information could then be used in combination with other attacks like DDoS to force services to switch guard nodes (HackerFactor Blog).

While the Tor Project considers this behavior intentional, several mitigation strategies have been suggested: 1) Using ExcludeNodes to exclude entire countries along with StrictNodes 2) Changing server IP addresses regularly when using IPv6 3) Implementing checks to verify rendezvous nodes against the known consensus list before connecting. Additionally, the Vanguards add-on was developed to help protect against guard discovery attacks (Tor Dev List).

The vulnerability generated discussion within the Tor development community, with some developers arguing this is intended behavior rather than a security flaw. The Tor network team officially stated that this behavior is by design and serves specific purposes in the network's operation (Tor Dev List).