Integer overflow in Nicmx Fort-Validator
CVE-2024-56375
An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Nicmx Fort-validator — versions 1.6.3
- Nicmx Fort_validator — versions 1.6.3, 1.6.4
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-56375?
- CVE-2024-56375 is a high-severity vulnerability in Nicmx Fort-Validator, classified under Integer Underflow. CVSS score: 7.5/10. Published 2024-12-22.
- How severe is CVE-2024-56375?
- High severity. CVSS v3 base score is 7.5 out of 10.