Security readout for executives and security teams
Plain-English summary
This flaw can make affected Tor clients crash when they process a malicious v3 onion service descriptor. The public bundle describes a denial-of-service style impact, not confirmed data theft or code execution. Business urgency depends on whether the organization runs older Tor clients or depends on Tor access for operations.
Executive priority
Treat as a targeted availability risk for older Tor deployments. Update affected clients promptly, especially where Tor connectivity supports business, research, or incident-response operations.
Technical view
CVE-2021-34550, also tracked as TROVE-2021-006, affects Tor before 0.4.6.5. The issue is in v3 onion service descriptor parsing and can cause out-of-bounds memory access leading to a client crash when a crafted descriptor is encountered.
Likely exposure
Exposure is most likely where Tor versions before 0.4.6.5 are installed and used to access v3 onion services. The bundle does not identify broader affected products beyond Tor.
Exploitation context
The provided sources describe a crafted onion service descriptor causing client crashes. CISA KEV is false in the bundle, and no cited source confirms active exploitation.
Researcher notes
The source bundle lacks CVSS, CWE, detailed affected CPEs, and exploit telemetry. Analysis should stay limited to Tor before 0.4.6.5 and the documented v3 onion descriptor parsing crash.
Mitigation direction
- Upgrade Tor to version 0.4.6.5 or later.
- Apply vendor or distribution security updates for Tor packages.
- Check Tor Project and distribution advisories for environment-specific guidance.
- Prioritize systems that rely on Tor client availability.
Validation and detection
- Inventory installed Tor versions across endpoints and servers.
- Confirm all Tor installations are 0.4.6.5 or later.
- Review package manager advisories for Tor security update status.
- Check operational logs for unexplained Tor client crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-34550 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gitlab.torproject.org/tpo/core/tor/-/issues/40392CVE reference · x_refsource_MISC
- https://blog.torproject.org/node/2041CVE reference · x_refsource_CONFIRM
- GLSA-202107-25CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.