CVE-2024-56375

What it actually does

Integer underflow in Fort when processing RPKI Manifest with empty fileList leads to dereference of invalid array, out-of-bounds access, infinite shuffle loop, and guaranteed crash.

Why it matters to the business

Denial of service against systems validating RPKI data, disrupting routing security checks until restart or patch.

How an attack unfolds

Attacker publishes malicious RPKI repository under a trusted Trust Anchor containing a Manifest with empty fileList served via rsync or RRDP; Fort processes the object, hits the underflow during shuffle before validation, and crashes from infinite loop and invalid memory access.

How to fix it

Upgrade Fort to version 1.6.5 or later; validate RPKI repositories only from trusted sources until patched.

How to confirm the fix worked

Confirm Fort version is 1.6.5 or newer; test by attempting to process a Manifest with empty fileList in a controlled environment and verify no crash occurs.

Typical attack path

1. Publish malicious RPKI repository descending from trusted Trust Anchor
2. Serve Manifest RPKI object with empty fileList via rsync or RRDP
3. Victim Fort instance fetches and processes the Manifest
4. Integer underflow occurs on empty fileList during array shuffle
5. Infinite loop and out-of-bounds write cause crash

How to detect it

Review Fort process crash logs and RPKI fetch logs for repeated attempts to process Manifest objects from repositories shortly before crashes; look for evidence of rsync or RRDP fetches of Manifests with zero-length file lists.

What your security team should do

• Immediately upgrade all Fort instances to 1.6.5
• Monitor for unexpected Fort crashes correlated with RPKI repository fetches
• Restrict RPKI validation to known trusted repositories pending patch