CVE-2024-56375: Integer Underflow
First published: Sun Dec 22 2024(Updated: )
An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiGate | >1.6.3<=1.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-56375?
CVE-2024-56375 has a medium severity rating due to the potential for exploitation resulting from an integer underflow.
How do I fix CVE-2024-56375?
To fix CVE-2024-56375, upgrade Fort to version 1.6.5 or later.
What software is affected by CVE-2024-56375?
CVE-2024-56375 affects Fort versions 1.6.3 and 1.6.4.
What vulnerability type is CVE-2024-56375?
CVE-2024-56375 is classified as an integer underflow vulnerability.
Can CVE-2024-56375 be exploited remotely?
Yes, CVE-2024-56375 can be exploited if an attacker provides a malicious RPKI repository.
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/trending
- agent/severity
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/references
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- vendor/fort
- canonical/fortinet fortigate