CVE-2024-45235

What it actually does

The validator dereferences an unsanitized pointer from the Authority Key Identifier extension when the keyIdentifier field is absent, causing a crash in the RPKI Relying Party process.

Why it matters to the business

Loss of Route Origin Validation availability can allow route hijacks or leaks to go undetected, increasing risk of traffic interception or disruption for organizations relying on RPKI-protected routing.

How an attack unfolds

An attacker who controls or compromises an RPKI repository descending from a trusted Trust Anchor publishes a resource certificate via rsync or RRDP that omits the keyIdentifier field in the Authority Key Identifier extension; when the validator processes the certificate it crashes without sanitizing the pointer, disabling validation until restart.

How to fix it

Upgrade nicmx/fort-validator to commit 554c5fa738791173dbf8261d68b4515708fc70ce or later; for Debian 11 upgrade libndp to 1.6-1+deb11u1, for Debian 12 to 1.8-1+deb12u1, and for Debian 13 to 1.8-2. Restart the validator service after upgrade and verify it processes repositories without crashing.

How to confirm the fix worked

Confirm the running binary or package version matches a listed fixed release, then replay a test repository containing a certificate with an Authority Key Identifier lacking the keyIdentifier field and verify the process remains stable.

Typical attack path

1. Attacker obtains or compromises an RPKI repository under a trusted Trust Anchor
2. Attacker crafts and serves a resource certificate lacking the keyIdentifier field in the Authority Key Identifier extension
3. Victim validator fetches the certificate via rsync or RRDP
4. Validator processes the extension and dereferences the unsanitized pointer
5. Process crashes and Route Origin Validation becomes unavailable

How to detect it

Search validator process logs and system crash reports for abrupt terminations during repository synchronization; correlate with rsync or RRDP fetch activity from untrusted or newly added repositories.

What your security team should do

• Apply the listed fixed versions immediately on all Fort validator instances
• Monitor upstream RPKI repository health and certificate validity before trusting new repositories
• Implement process supervision and automatic restart with alerting on validator crashes
• Review RPKI trust anchor configuration to minimize exposure to unvetted repositories