CVE-2026-77584

CVE-2026-77584 is a use-after-free in Tor relays triggered by a malicious client violating an implicit protocol ordering assumption. The vulnerability isn't a classic memory safety bug—it's a state machine enforcement failure. The Tor protocol assumes CONFLUX_LINK cells arrive only on circuits without attached streams, but this invariant was never validated at the receiving end. A malicious client exploits this by sending RELAY_COMMAND_BEGIN before CONFLUX_LINK, attaching an exit stream to a circuit intended for link migration. When CONFLUX_LINK arrives later, the handler doesn't reject the out-of-order cell, and circuit teardown eventually produces a dangling back-pointer and UAF. The fix—rejecting CONFLUX_LINK on circuits with active streams—is a protocol layer correction, not memory allocator hardening. The underlying memory management was likely adequate; what failed was the state machine's assumption that certain cell types would only appear in certain circuit states. This pattern should concern you because CONFLUX is a relatively new extension (addressing multipath routing resilience), and new protocol extensions in Tor have historically concentrated state machine failures that manifest as memory safety bugs. For relay operators, the risk calculus is nuanced. Tor's threat model already assumes clients may be malicious—this is why circuit extension handshakes validate incoming data. The EPSS score of 0.00176 likely reflects this rather than genuine exploitation difficulty. However, the shift from confidentiality leaks (earlier protocol gaps) to a reliable relay crash vector (this UAF) changes the operational impact: protocol non-compliance now has direct availability consequences rather than metadata leakage. The deeper question is whether other Tor relay cells have similar unstated ordering assumptions that go unenforced. The CONFLUX protocol specification describes feature semantics but appears to lack explicit state machine preconditions for each cell type. That's where the review gap lives—not in the memory handling itself, but in protocol specification that treats invariants as implicit rather than load-bearing.

Reviewed through automated stages and approved by a human before publication.