CVE-2024-35312: 
Rust vulnerability analysis and mitigation

A security vulnerability identified as CVE-2024-35312 affects Tor Arti versions before 1.2.3. The vulnerability, also known as TROVE-2024-003, involves STUB circuits incorrectly having a length of 2 when using lite vanguards (NVD, MITRE).

The vulnerability stems from a bug where STUB circuits are never extended past the L2 vanguard when lite vanguards are in use. The issue occurs because a specific condition lacks an else branch, causing the circuit to be returned after adding an L2 vanguard, which is incorrect behavior (Tor GitLab). The vulnerability has been assigned a CVSS v3.1 base score of 6.2 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability affects the availability of the Tor network connections through Arti, as indicated by the CVSS metrics showing high impact on availability but no impact on confidentiality or integrity (NVD).

The vulnerability requires local access with no privileges and no user interaction for exploitation, as indicated by the CVSS metrics (NVD).

Users should upgrade to Tor Arti version 1.2.3 or later to address this vulnerability (NVD).