CVE-2021-34550: 
NixOS vulnerability analysis and mitigation

An out-of-bounds memory access vulnerability was discovered in Tor before version 0.4.6.5, identified as CVE-2021-34550 (also known as TROVE-2021-006). The vulnerability affects the v3 onion service descriptor parsing functionality, which could allow attackers to cause client crashes through crafted onion service descriptors (Tor Blog, NVD).

The vulnerability exists in the desc_decode_encrypted_v3 function where the R3_INTRO_AUTH_REQUIRED token handling contains a flaw. The function assumes that the token always has an argument at index 0, but the ARGS macro indicates that the token can have any number of arguments (including zero). This assumption can lead to an out-of-bounds memory access when processing maliciously crafted descriptors (GitLab Issue).

When exploited, this vulnerability allows an attacker to crash Tor clients attempting to visit a maliciously crafted onion service. The impact is primarily a denial of service condition, though there is a possibility of a very limited information leak (Tor Blog, GitLab Issue).

The vulnerability can be exploited by creating a malicious onion service descriptor that triggers the out-of-bounds read condition. While the out-of-bounds pointer value can be controlled, it was assessed that the issue is extremely unlikely to be used for anything beyond causing denial of service (GitLab Issue).

The vulnerability was fixed in Tor version 0.4.6.5. Users and administrators are advised to upgrade to this version or later. For specific distributions, such as Gentoo, users should upgrade to tor-0.4.6.5 or later versions (Gentoo Security).