CVE-2022-33903: 
NixOS vulnerability analysis and mitigation

Tor 0.4.7.x before 0.4.7.8 contains a high-severity denial of service vulnerability that allows attackers to exploit the RTT (Round Trip Time) estimation mechanism. The vulnerability, identified as CVE-2022-33903, was discovered and disclosed in June 2022, affecting all Tor versions from 0.4.7.1-alpha to 0.4.7.7 (Tor Announce).

The vulnerability stems from a scenario where RTT estimation can become wedged, which seriously degrades congestion control performance on all circuits. This issue impacts clients, onion services, and relays, and can be triggered remotely by a malicious endpoint. The vulnerability was categorized as TROVE-2022-001 and was fixed in version 0.4.7.8 (Tor Announce).

The vulnerability affects the congestion control mechanism in Tor, leading to degraded performance across all circuits. While classified as a denial of service vulnerability, it does not compromise the security of the host machine running Tor. The impact extends to clients, onion services, and relays within the Tor network (Tor Announce).

The vulnerability was patched in Tor version 0.4.7.8. Users and administrators are strongly encouraged to upgrade to this version or later to mitigate the risk. No alternative workarounds were provided, making the upgrade the only effective mitigation strategy (Tor Announce, Gentoo Security).