Fatal error on incorrect base64 data in RRDP

Vulnerability

Overview

CVE-2022-3029 is a denial-of-service vulnerability in NLnet Labs Routinator versions 0.9.0 through 0.11.2. The root cause is a mistake in error handling when processing RRDP snapshot and delta files: if the data is not correctly base64 encoded, Routinator treats it as a fatal error and exits instead of gracefully skipping or logging the malformed entry [1][2].

Exploitation

An attacker who can control or inject content into the RRDP repositories that Routinator fetches (e.g., via a man-in-the-middle attack or by compromising an RPKI repository) can trigger this vulnerability. No authentication is required beyond the ability to serve malicious RRDP data. The attacker does not need any special network position other than being able to influence the data Routinator downloads [2].

Impact

The immediate impact is a denial of service: Routinator exits, stopping the provision of RPKI data to routers. This prevents routers from validating route origins based on RPKI, potentially allowing invalid routes to be accepted. Importantly, the vulnerability does not allow an attacker to manipulate RPKI data itself [2].

Mitigation

The issue is fixed in Routinator version 0.11.3 [3]. Users should upgrade to this version or later. The fix modifies the error handling to no longer treat malformed base64 data as a fatal error [1].