CVE-2024-56375

published 2024-12-22

CVE-2024-56375: An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve…

Priority P3 38 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	fort-validator	< fort-validator 1.6.5-1 (forky)	fort-validator 1.6.5-1 (forky)
nicmx	fort-validator	>= 0 < 1.6.5-1	1.6.5-1
nicmx	fort-validator	>= 0 < 1.6.5-1	1.6.5-1
nicmx	fort-validator	>= 1.6.3 < 1.6.5	1.6.5
nicmx	fort_validator	—	—
nicmx	fort_validator	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH

vendor_debian 7.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-191