CVE-2018-6156

What it actually does

Incorrect packet length derivation in WebRTC causes heap corruption when processing crafted video content, enabling memory safety violations.

Why it matters to the business

Remote attackers can achieve code execution or denial of service against systems using affected Tor packages, risking data exposure, service outages, and potential compromise of anonymity-focused deployments.

How an attack unfolds

An attacker crafts a malicious video file that triggers incorrect length calculations inside WebRTC; when the victim processes the file through an affected Tor package, heap memory is corrupted, allowing potential arbitrary code execution.

How to fix it

Upgrade tor packages to the listed fixed versions: Debian 11/12/13 to 0.3.1.9-1; Ubuntu 16.04 LTS to 0.2.9.14-1ubuntu1~16.04.2; Ubuntu 18.04 LTS to 0.3.1.9-1. Remove or isolate unpatched instances until updated.

How to confirm the fix worked

Query package manager for installed tor version and compare against fixed releases; test WebRTC video handling in a controlled environment to confirm absence of the length derivation flaw.

Typical attack path

1. Craft malicious video file exploiting packet length miscalculation
2. Deliver file to target via web, email, or file share
3. Victim opens or renders the file in affected application
4. WebRTC processes malformed packet data leading to heap corruption
5. Attacker leverages corruption for code execution or crash

How to detect it

Review application logs and crash reports for WebRTC-related heap errors or unexpected terminations during video processing; correlate with file access timestamps of suspicious video content.

What your security team should do

• Apply the exact fixed tor package versions immediately due to memory corruption severity
• Prioritize patching systems handling video or real-time media
• Monitor for new EPSS increases or exploit code publication
• Harden WebRTC usage policies until upgrades complete