An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.
This issue impacts:
PAN-OS 8.1 versions earlier than PAN-OS 8.1.20;
PAN-OS 9.0 versions earlier than PAN-OS 9.0.14;
PAN-OS 9.1 versions earlier than PAN-OS 9.1.9;
PAN-OS 10.0 versions earlier than PAN-OS 10.0.5.
This issue does not affect Prisma Access.
|PAN-OS 10.0||< 10.0.5||>= 10.0.5|
|PAN-OS 9.1||< 9.1.9||>= 9.1.9|
|PAN-OS 9.0||< 9.0.14||>= 9.0.14|
|PAN-OS 8.1||< 8.1.20||>= 8.1.20|
This issue is applicable only if GTP security is configured on the firewall.
CVSSv3.1 Base Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Palo Alto Networks is not aware of any malicious exploitation of this issue.
This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.9, PAN-OS 10.0.5, and all later PAN-OS versions.
Enable signatures for Unique Threat ID 91593 on traffic processed by the firewall to block attacks against CVE-2021-3053.