Tor 0.4.9.15 fixes bug where clients permanently shun exits after transient errors
A bug in Tor's nodelist handling caused clients to permanently mark an exit relay as rejecting all traffic after receiving a single transient RELAY_END message, such as RESOURCELIMIT or HIBERNATING. This issue, introduced in Tor 0.2.3.1-alpha, allowed a third party to steer clients away from honest exits by exhausting an exit's sockets or sending a malicious END. The fix, which clears the 'rejects_all' flag when a new consensus is installed, is slated for the next stable release.
Why it matters
This fix prevents a remote attacker from manipulating a client's usable exit set, which could otherwise lead to targeted denial of service or privacy leaks by biasing circuit selection.
Event status Developing
Read the sources
- [T3-W81] `rejects_all` set by one transient RELAY_END is never cleared gitlab.torproject.org
- Public comment by @arma gitlab.torproject.org
- Public comment by @arma gitlab.torproject.org
This is an AI-assisted summary of the linked public sources. Consult the original reports for details and operator guidance.