CVE-2024-56375: nicmx fort_validator Integer Underflow (Wrap or Wraparound)

Vulnerability summary

CVE-2024-56375 is a high (CVSS 7.5) Integer Underflow (Wrap or Wraparound) vulnerability in nicmx fort_validator. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities.

Timeline

1. 22-12-2024
   PublishedVulnerability first disclosed.
2. 06-01-2025
   Last modifiedVulnerability information updated.

Description

An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.