CVE-2017-8822

Vulnerability

In Tor versions before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, a relay that has an incompletely downloaded descriptor can pick itself in a circuit path [1]. This "self-picking" behavior occurs due to a flaw in the circuit path selection logic when descriptor data is incomplete, allowing the relay to be included as a hop in a circuit it is participating in constructing.

Exploitation

An attacker controlling or operating a Tor relay that has an incompletely downloaded descriptor (possibly due to network conditions or deliberate manipulation) can cause that relay to be selected as a hop in a circuit path built by other Tor clients or relays [1]. No special authentication or user interaction is required beyond running a relay with the incomplete descriptor; the normal circuit-building process automatically makes the selection.

Impact

Successful exploitation degrades the anonymity of Tor users whose circuits include the attacker-controlled relay. Since the relay is both a participant in the circuit and can see its own selection, it may gain additional information about the circuit's origin or destination, potentially correlating traffic flows [1]. The attack does not directly reveal plaintext content but weakens the network's ability to anonymize connections.

Mitigation

Tor has released fixed versions: 0.2.5.16, 0.2.8.17, 0.2.9.14, 0.3.0.13, 0.3.1.9, and 0.3.2.6-alpha [1]. All users and relay operators should upgrade to one of these versions. No known workaround exists for unpatched installations; upgrading is the recommended mitigation.