CVE-2024-9468 PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

Palo Alto Networks Security Advisories / CVE-2024-9468

CVE-2024-9468 PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

Severity 8.2 · HIGH

Urgency MODERATE

Response Effort LOW

Recovery USER

Value Density CONCENTRATED

Attack Vector NETWORK

Attack Complexity HIGH

Attack Requirements NONE

Automatable YES

User Interaction NONE

Product Confidentiality NONE

Product Integrity NONE

Product Availability HIGH

Privileges Required NONE

Subsequent Confidentiality NONE

Subsequent Integrity NONE

Subsequent Availability NONE

NVD JSON

Published 2024-10-09

Updated 2024-10-14

Reference PAN-244840

Discovered internally

Description

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Product Status

Versions	Affected	Unaffected
Cloud NGFW	None	All
PAN-OS 11.2	None	All
PAN-OS 11.1	< 11.1.3	>= 11.1.3
PAN-OS 11.0	< 11.0.4-h5, < 11.0.6	>= 11.0.4-h5, >= 11.0.6
PAN-OS 10.2	< 10.2.9-h11, < 10.2.10-h4, < 10.2.11	>= 10.2.9-h11, >= 10.2.10-h4, >= 10.2.11
PAN-OS 10.1	None	All
Prisma Access	None	All

Required Configuration for Exposure

This issue affects only PAN-OS configurations where all of the following are true:

* Threat Prevention is enabled.

* The Threat Prevention signature 86467 ("Possible Domain Fronting Detection-SNI") is enabled on an Anti-Spyware profile.

* This setting is enabled: Device > Setup > Session > Decryption Settings > SSL Decryption Settings > Send handshake messages to CTD for inspection.

Severity: HIGH

CVSSv4.0 Base Score: 8.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-787 Out-of-bounds Write

Solution

This issue is fixed in 10.2.9-h11, 10.2.10-h4, PAN-OS 10.2.11, PAN-OS 11.0.4-h5, PAN-OS 11.0.6, PAN-OS 11.1.3, and all later PAN-OS versions.

Workarounds and Mitigations

Customers can block attacks for this vulnerability by disabling this setting: Device > Setup Session > Decryption Settings > SSL Decryption Settings > Send handshake messages to CTD for inspection.

Customers with a Threat Prevention subscription, who want to keep domain fronting detection enabled, can block attacks for this vulnerability by enabling Threat ID 94971 (introduced in Applications and Threats content version 8854).

Acknowledgments

This issue was found by Jeff Luo of Palo Alto Networks during internal review.

Timeline

2024-10-14 Clarified the Required Configuration for Exposure section

2024-10-09 Initial publication