CVE-2024-56375 is an integer underflow vulnerability classified under CWE-191 found in nicmx's fort-validator versions 1.6.3 and 1.6.4 prior to 1.6.5. The flaw occurs when fort-validator processes a Manifest RPKI object containing an empty fileList served by a malicious RPKI repository that is descended from a trusted Trust Anchor. During the shuffle operation of the fileList array, the code dereferences and writes to this empty array before the validation logic that would normally reject an empty fileList is executed. This leads to an integer underflow causing the loop controlling the shuffle to iterate infinitely, resulting in out-of-bounds memory access. The consequence is a near-certain crash of the fort-validator process, causing a denial of service. The vulnerability can be triggered remotely via standard RPKI repository synchronization protocols such as rsync or RRDP without requiring any authentication or user interaction. The CVSS v3.1 score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, and a significant impact on availability. No known exploits have been reported in the wild as of the publication date. The vulnerability affects critical components of the RPKI ecosystem, which is essential for securing internet routing infrastructure.

The primary impact of CVE-2024-56375 is a denial of service condition on fort-validator instances used in RPKI validation. Organizations relying on fort-validator for validating RPKI data may experience service outages or disruptions in routing security validation, potentially leading to degraded network security posture. This can affect ISPs, internet exchange points, and enterprises that depend on RPKI to prevent route hijacking and misconfigurations. The vulnerability does not directly compromise confidentiality or integrity but undermines availability, which can indirectly increase the risk of routing attacks if validation services are unavailable. Since fort-validator is a critical component in the RPKI ecosystem, widespread exploitation could disrupt internet routing security infrastructure, especially in regions with heavy RPKI adoption. The ease of remote exploitation without authentication increases the risk of automated attacks causing outages.

To mitigate CVE-2024-56375, organizations should immediately upgrade fort-validator to version 1.6.5 or later, where the integer underflow and associated infinite loop have been fixed. Until an upgrade is possible, administrators should consider implementing network-level filtering to restrict access to RPKI repository synchronization endpoints (rsync and RRDP) to trusted sources only, reducing exposure to malicious repositories. Monitoring fort-validator logs and system health for signs of crashes or infinite loops can provide early detection of exploitation attempts. Additionally, validating the integrity and correctness of RPKI repository data before processing can help prevent malformed manifests from triggering the vulnerability. Organizations should also maintain up-to-date backups and failover mechanisms for RPKI validation services to minimize downtime. Engaging with the fort-validator vendor or community for patches and advisories is recommended.