CVE-2024-45238

What it actually does

Improper handling of a malformed Subject Public Key bit string in an RPKI resource certificate causes an invalid pointer dereference (when built against OpenSSL libcrypto < 3) during certificate parsing from a trusted Trust Anchor descendant, resulting in a crash of the RPKI validator.

Why it matters to the business

Loss of Route Origin Validation availability can allow routing hijacks or leaks that disrupt network reachability and traffic flow for dependent operators.

How an attack unfolds

An attacker publishes a malicious RPKI repository under a trusted Trust Anchor that includes a resource certificate containing an improperly encoded Subject Public Key bit string. A Fort validator fetches the repository via rsync or RRDP, OpenSSL silently accepts the malformed structure, and Fort dereferences an invalid pointer, crashing and disabling validation.

How to fix it

Upgrade nicmx/fort-validator to the commit 554c5fa738791173dbf8261d68b4515708fc70ce or later release that contains the fix (version 1.6.3 or newer). Rebuild against OpenSSL 3.x when possible and verify the binary no longer crashes on the provided test vectors.

How to confirm the fix worked

Confirm the running binary reports version 1.6.3 or contains commit 554c5fa738791173dbf8261d68b4515708fc70ce; replay the malformed certificate test case from the advisory against a non-production instance and verify the process does not crash.

Typical attack path

1. Attacker creates or compromises an RPKI repository descending from a trusted Trust Anchor
2. Repository is populated with a resource certificate containing a non-decodable Subject Public Key bit string
3. Target Fort instance performs a fetch via rsync or RRDP
4. Certificate parsing occurs without OpenSSL error reporting
5. Invalid pointer dereference triggers process crash and validation outage

How to detect it

Monitor validator process logs and system crash reports for abrupt terminations during RPKI repository fetches; correlate restarts with rsync or RRDP activity from untrusted or newly observed repositories.

What your security team should do

• Immediately schedule upgrade of all Fort validator instances to the fixed commit
• Add the validator process to crash-monitoring and automatic restart procedures
• Review RPKI fetch logs for repeated failures or restarts coinciding with repository updates
• Test the patched build with the supplied malformed certificate before production deployment