CVE-2024-2551: Palo Alto PAN-OS DoS Vulnerability

CVE-2024-2551 Overview

CVE-2024-2551 is a null pointer dereference vulnerability [CWE-476] in Palo Alto Networks PAN-OS software. An unauthenticated attacker can stop a core system service on the firewall by sending a crafted packet through the data plane. Repeated exploitation attempts force the firewall into maintenance mode, removing it from active service.

The flaw affects multiple PAN-OS versions, including 10.2.4 and several hotfix releases. The vulnerability requires no privileges or user interaction and is exploitable across the network.

Critical Impact

Unauthenticated remote attackers can trigger a denial of service condition that stops core firewall services and forces the device into maintenance mode after repeated exploitation.

Affected Products

• Palo Alto Networks PAN-OS 10.2.4
• Palo Alto Networks PAN-OS 10.2.4-h2, 10.2.4-h3, 10.2.4-h4
• Additional PAN-OS versions identified in the vendor advisory

Discovery Timeline

• 2024-11-14 - CVE-2024-2551 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-2551

Vulnerability Analysis

The vulnerability resides in PAN-OS data plane packet processing. A crafted packet sent to the firewall triggers a null pointer dereference within a core system service. The dereference causes the affected service to terminate, interrupting traffic processing functions that depend on it.

Repeated triggering of the condition escalates impact beyond a single service crash. The firewall transitions into maintenance mode, a recovery state in which normal operation is suspended. Administrative intervention is required to restore the device to production.

Because the attack traverses the data plane, any network path that can deliver packets to the firewall's processing engine is a viable vector. Authentication is not required, and the attacker does not need to interact with management interfaces.

Root Cause

The root cause is improper validation of a pointer prior to dereference within PAN-OS packet handling logic. When the affected code path encounters specific malformed or unexpected packet content, it accesses a null pointer instead of a valid memory address. This triggers a fatal fault in the service process.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker delivers a crafted packet through the data plane of a vulnerable PAN-OS firewall. The packet exercises the vulnerable code path and crashes the targeted service. The vulnerability does not yield code execution or data exposure but produces availability impact. Refer to the Palo Alto Networks Advisory for protocol-specific details.

Detection Methods for CVE-2024-2551

Indicators of Compromise

• Unexpected restarts or crashes of core PAN-OS data plane services recorded in system logs
• Firewall transitions into maintenance mode without administrator action
• Repeated dataplane process termination events in the device system log
• Loss of traffic forwarding correlated with inbound traffic from a single source

Detection Strategies

• Monitor PAN-OS system logs for service restart and crash events linked to packet processing components
• Alert on any maintenance mode transition events, which indicate cumulative service failures
• Correlate firewall availability drops with packet capture data to identify the triggering source

Monitoring Recommendations

• Forward PAN-OS system and configuration logs to a centralized SIEM for retention and correlation
• Configure SNMP and syslog alerts for firewall health state changes and service failures
• Track high availability (HA) failover events that may indicate an attacker disrupting the active peer

How to Mitigate CVE-2024-2551

Immediate Actions Required

• Identify all PAN-OS devices running affected versions, including 10.2.4 and its hotfix branches
• Apply the fixed PAN-OS release listed in the vendor advisory as soon as maintenance windows allow
• Restrict data plane exposure of management and untrusted interfaces using access control lists where feasible
• Verify high availability configurations so a single device failure does not disrupt traffic

Patch Information

Palo Alto Networks has published fixed PAN-OS versions and remediation guidance in the Palo Alto Networks Advisory for CVE-2024-2551. Administrators should consult the advisory to confirm the specific fixed release for each affected branch and upgrade accordingly.

Workarounds

• Limit the network sources that can reach data plane interfaces using upstream filtering and zone-based policies
• Deploy PAN-OS firewalls in active/passive HA pairs to reduce outage duration if a device enters maintenance mode
• Apply threat prevention signatures published by Palo Alto Networks that address this issue, as referenced in the advisory

# Example: review PAN-OS version and recent system events from CLI
show system info | match sw-version
show system logs system direction equal backward