CVE-2017-0380: Insertion of Sensitive Information into Log File (CWE-532)
value: The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 5.9
Published: 2017-09-18T16:29Z
Repository: https://github.com/torproject/tor
Language: Other
Files changed: changes/trove-2017-008, src/or/rendservice.c
Commit date: 2017-09-18 09:32:41 -0400
Commit message: Fix log-uninitialized-stack bug in rend_service_intro_established.

Fixes bug 23490; bugfix on 0.2.7.2-alpha.

TROVE-2017-008
CVE-2017-0380

Diff: diff --git a/changes/trove-2017-008 b/changes/trove-2017-008
new file mode 100644
index 0000000000..4b9c5b0a12
--- /dev/null
+++ b/changes/trove-2017-008
@@ -0,0 +1,5 @@
+  o Major bugfixes (security, hidden services, loggging):
+    - Fix a bug where we could log uninitialized stack when a certain
+      hidden service error occurred while SafeLogging was disabled.
+      Fixes bug #23490; bugfix on 0.2.7.2-alpha.
+      This is also tracked as TROVE-2017-008 and CVE-2017-0380.
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index fb777ca154..8087e88499 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -3370,10 +3370,12 @@ rend_service_intro_established(origin_circuit_t *circuit,
   if (!service) {
     log_warn(LD_REND, "Unknown service on introduction circuit %u.",
              (unsigned)circuit->base_.n_circ_id);
     goto err;
   }
+  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
+                rend_pk_digest, REND_SERVICE_ID_LEN);
   /* We've just successfully established a intro circuit to one of our
    * introduction point, account for it. */
   intro = find_intro_point(circuit);
   if (intro == NULL) {
     log_warn(LD_REND,
@@ -3386,12 +3388,10 @@ rend_service_intro_established(origin_circuit_t *circuit,
   /* We might not have every introduction point ready but at this point we
    * know that the descriptor needs to be uploaded. */
   service->desc_is_dirty = time(NULL);
   circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_INTRO);
 
-  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
-                rend_pk_digest, REND_SERVICE_ID_LEN);
   log_info(LD_REND,
            "Received INTRO_ESTABLISHED cell on circuit %u for service %s",
            (unsigned)circuit->base_.n_circ_id, serviceid);
 
   /* Getting a valid INTRODUCE_ESTABLISHED means we've successfully

Vulnerable code:   base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
                rend_pk_digest, REND_SERVICE_ID_LEN);
Fixed code:   o Major bugfixes (security, hidden services, loggging):
    - Fix a bug where we could log uninitialized stack when a certain
      hidden service error occurred while SafeLogging was disabled.
      Fixes bug #23490; bugfix on 0.2.7.2-alpha.
      This is also tracked as TROVE-2017-008 and CVE-2017-0380.
  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
                rend_pk_digest, REND_SERVICE_ID_LEN);