Palo Alto Networks Security Advisories / CVE-2024-2551

CVE-2024-2551 PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

Urgency MODERATE

047910
Severity 6.6 · MEDIUM
Exploit Maturity UNREPORTED
Response Effort MODERATE
Recovery USER
Value Density CONCENTRATED
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction NONE
Product Confidentiality NONE
Product Integrity NONE
Product Availability HIGH
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE
CVE JSON
Published 2024-11-13
Updated 2024-11-13
Reference PAN-223185
Discovered externally

Description

A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

Product Status

VersionsAffectedUnaffected
Cloud NGFWNoneAll
PAN-OS 11.2NoneAll
PAN-OS 11.1NoneAll
PAN-OS 11.0< 11.0.5>= 11.0.5
PAN-OS 10.2< 10.2.4-h6, < 10.2.5>= 10.2.4-h6, >= 10.2.5
PAN-OS 10.1< 10.1.14>= 10.1.14
Prisma AccessNoneAll

Severity: MEDIUM, Suggested Urgency: MODERATE

CVSS-BT: 6.6 / CVSS-B: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-476 NULL Pointer Dereference

CAPEC-129 Pointer Manipulation

Solution

This issue is fixed in PAN-OS 10.1.14, PAN-OS 10.2.4-h6, PAN-OS 10.2.5, PAN-OS 11.0.5, and all later PAN-OS versions.

Acknowledgments

Palo Alto Networks thanks a customer for discovering and reporting the issue.

CPEs

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.0:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h13:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.13:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.13:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.12:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.7:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.7:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.2:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.1:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1.0:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.1:-:*:*:*:*:*:*

Timeline

Initial publication
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2024 Palo Alto Networks, Inc. All rights reserved.