Palo Alto Networks PAN-OS Malformed DNS Packet Vulnerability (CVE-2024-3393)

In December 2024, Palo Alto Networks disclosed a significant vulnerability in its PAN-OS software, identified as CVE-2024-3393. This flaw affects the DNS Security feature of PAN-OS, potentially allowing unauthenticated attackers to disrupt firewall operations through specially crafted DNS packets.

Understanding the Vulnerability

The vulnerability arises from improper parsing and logging of malformed DNS packets within the DNS Security feature. An attacker can exploit this flaw by sending a malicious packet through the firewall's data plane, causing the device to reboot. Repeated exploitation may force the firewall into maintenance mode, rendering it inoperative until manual intervention is performed.

Impacted Systems

The following PAN-OS versions are affected:

PAN-OS 11.2: Versions below 11.2.3
PAN-OS 11.1: Versions below 11.1.5
PAN-OS 10.2: Versions between 10.2.8 and 10.2.14
PAN-OS 10.1: Versions between 10.1.14 and 10.1.15

It's important to note that PAN-OS 11.0 has reached its end-of-life and will not receive a patch. Therefore, systems running this version are particularly vulnerable and should be upgraded promptly.

Severity and Exploitation Status

This vulnerability has been assigned a CVSS score of 8.7 (High) for unauthenticated scenarios, indicating a significant risk. Palo Alto Networks has confirmed active exploitation of this flaw, with reports of customers experiencing denial-of-service conditions due to malicious DNS packets triggering the issue.

Mitigation and Remediation

Palo Alto Networks has released patches to address this vulnerability. Affected organizations are strongly advised to upgrade to the following PAN-OS versions:

PAN-OS 11.2.3 or later
PAN-OS 11.1.5 or later
PAN-OS 10.2.14 or later (ETA: end of January 2025)
PAN-OS 10.1.15 or later (ETA: end of January 2025)

For environments where immediate upgrading is not feasible, the following workarounds can be applied:

Clone predefined Anti-Spyware profiles (e.g., "Default" or "Strict") in the Security Policy and replace them with custom profiles.
Within each custom Anti-Spyware profile, navigate to the DNS Security settings and set the Log Severity to "none" for all configured DNS Security categories.
Commit the changes to apply the new settings.

These measures should be considered temporary, and normal logging settings should be restored once the system is patched.

Recommendations

Organizations utilizing Palo Alto Networks' PAN-OS are urged to:

Assess their current PAN-OS version and determine if it is within the affected range.
Plan and execute an upgrade to the recommended versions as soon as possible.
Apply the suggested workarounds if immediate upgrading is not possible.
Monitor firewall logs and system behavior for any signs of exploitation, such as unexpected reboots or entries into maintenance mode.

Maintaining up-to-date systems and promptly applying security patches are critical steps in safeguarding network infrastructure against emerging threats.