CVE-2024-3385: Palo Alto PAN-OS DoS Vulnerability

CVE-2024-3385 Overview

A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. This denial of service vulnerability exists due to improper input validation (CWE-20) combined with a null pointer dereference condition (CWE-476) in the packet processing engine. When exploited, repeated attacks can force the firewall into maintenance mode, requiring manual intervention to restore normal operations.

This vulnerability specifically targets hardware-based firewall appliances in the PA-5400 Series and PA-7000 Series, making it particularly impactful for enterprise environments relying on these high-performance security appliances for network protection.

Critical Impact

Remote attackers can cause repeated reboots of affected Palo Alto Networks hardware firewalls, eventually forcing them into maintenance mode and requiring manual recovery, resulting in extended network security outages.

Affected Products

• Palo Alto Networks PAN-OS (multiple versions)
• PA-5400 Series firewalls (PA-5410, PA-5420, PA-5430, PA-5440, PA-5445)
• PA-7000 Series firewalls (PA-7050, PA-7080)

Discovery Timeline

• April 10, 2024 - CVE-2024-3385 published to NVD
• January 24, 2025 - Last updated in NVD database

Technical Details for CVE-2024-3385

Vulnerability Analysis

This vulnerability resides in the packet processing mechanism of PAN-OS software running on specific hardware firewall models. The flaw stems from improper input validation when handling specially crafted network packets. When the affected firewall receives malicious packets, the processing engine fails to properly validate input data, leading to a null pointer dereference condition that crashes the system.

The attack requires no authentication or user interaction, making it particularly dangerous for internet-facing firewall deployments. An attacker with network access to the vulnerable firewall can repeatedly send malicious packets to trigger system reboots. After multiple reboot cycles, the firewall enters maintenance mode as a protective measure, but this results in complete loss of network security functionality until an administrator manually restores the device.

The vulnerability is limited to hardware-based firewalls in the PA-5400 and PA-7000 series. Virtual firewall instances (VM-Series) and other hardware models are not affected by this specific issue.

Root Cause

The root cause involves two related weaknesses: improper input validation (CWE-20) and null pointer dereference (CWE-476). The packet processing code fails to properly validate certain input parameters before dereferencing pointers, allowing attackers to trigger a null pointer dereference condition. This design flaw in the input validation routines allows specially crafted packets to reach code paths that assume valid data, resulting in a crash when the null pointer is accessed.

Attack Vector

The attack vector is network-based and can be exploited remotely without authentication. An attacker can send specially crafted packets to the firewall's network interfaces to trigger the vulnerability. The attack does not require any user interaction and can be launched from any network position that can route packets to the affected firewall.

The attack methodology involves:

1. Identifying a vulnerable Palo Alto Networks hardware firewall (PA-5400 or PA-7000 series)
2. Crafting malicious network packets designed to trigger the null pointer dereference
3. Sending repeated packets to cause multiple reboots
4. Waiting for the firewall to enter maintenance mode, disabling network protection

Detection Methods for CVE-2024-3385

Indicators of Compromise

• Unexpected firewall reboots without scheduled maintenance or known cause
• Multiple system restart events in quick succession recorded in firewall logs
• Firewall entering maintenance mode without administrator action
• Unusual inbound packet patterns targeting firewall management or data plane interfaces
• System crash logs indicating null pointer dereference errors in packet processing

Detection Strategies

• Monitor firewall health metrics for unexpected reboot events and system availability drops
• Configure SNMP or syslog alerts for firewall restart and maintenance mode events
• Implement network traffic analysis to detect anomalous packet patterns targeting firewall interfaces
• Review PAN-OS system logs for crash reports and error messages related to packet processing
• Deploy network monitoring to track firewall uptime and service availability metrics

Monitoring Recommendations

• Enable comprehensive logging on affected PA-5400 and PA-7000 series firewalls
• Configure alerting for any unplanned firewall reboots or state changes
• Monitor network traffic to firewall interfaces for unusual volume or packet characteristics
• Establish baseline uptime metrics to quickly detect availability anomalies
• Implement redundant monitoring paths to ensure visibility even during firewall outages

How to Mitigate CVE-2024-3385

Immediate Actions Required

• Review the Palo Alto Networks security advisory for CVE-2024-3385 for specific affected versions
• Identify all PA-5400 Series and PA-7000 Series firewalls in your environment
• Prioritize patching for internet-facing and critical path firewalls
• Implement network segmentation to limit exposure of management interfaces
• Prepare manual recovery procedures in case firewalls enter maintenance mode

Patch Information

Palo Alto Networks has released security patches to address this vulnerability. Organizations should consult the official vendor security advisory for specific version information and upgrade paths for affected PAN-OS versions.

Affected PAN-OS versions include releases in the 9.0.x, 9.1.x, 10.0.x, 10.1.x, and 10.2.x branches running on PA-5400 and PA-7000 series hardware. Organizations should upgrade to the latest patched versions as specified in the vendor advisory.

Workarounds

• Implement strict access control lists to limit network access to firewall interfaces
• Deploy rate limiting on network segments with access to affected firewalls
• Configure high availability (HA) pairs to minimize impact of individual firewall outages
• Enable automatic recovery settings where available to reduce maintenance mode duration
• Consider deploying additional security controls in front of affected firewalls

# Example: Review firewall model and PAN-OS version
show system info | match model
show system info | match sw-version

# Example: Check for recent unexpected reboots
show system state filter sw.restart-reason
show system state filter sw.system.restarts