CVE-2024-3393: Palo Alto PAN-OS DNS Security DoS Flaw

CVE-2024-3393 Overview

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Critical Impact
Attackers can persistently disrupt network security appliances, leading to service outages and maintenance mode conditions.

Affected Products

paloaltonetworks pan-os
paloaltonetworks prisma_access

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to paloaltonetworks
Not Available - CVE CVE-2024-3393 assigned
Not Available - paloaltonetworks releases security patch
2024-12-27 - CVE CVE-2024-3393 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-3393

Vulnerability Analysis

The vulnerability resides in the DNS Security feature of PAN-OS where a malformed packet, when processed, causes the firewall device to reboot. This scenario can be exploited repeatedly to force the device into maintenance mode.

Root Cause

The root cause lies in how malicious packets are improperly processed, leading to a system crash.

Attack Vector

The attack vector is over the network, allowing unauthenticated attackers to exploit the vulnerability remotely.

// Example exploitation code (sanitized)
#include <stdio.h>
#include <stdlib.h>

int main() {
    // Malformed packet creation
    printf("Triggering malformed packet to cause DoS...\n");
    // Simulated payload affecting PAN-OS
    return 0;
}

Detection Methods for CVE-2024-3393

Indicators of Compromise

Unscheduled reboots of PAN-OS devices
Entry into maintenance mode
Increased network traffic from known malicious IPs targeting DNS security

Detection Strategies

Network intrusion detection systems (NIDS) can be configured to identify unusual patterns of DNS requests. Investigate specific logs that show repeated failed DNS requests leading up to a system crash.

Monitoring Recommendations

Continuous monitoring of firewall logs for any anomalies and consistent checking of system stability or unexpected reboots.

How to Mitigate CVE-2024-3393

Immediate Actions Required

Disconnect affected devices from the network to prevent further exploitation
Monitor logs for unusual activity and patterns related to DNS requests
Alert response teams upon any unexpected reboots or changes in firewall status

Patch Information

Ensure that the firewall software is updated according to the vendor’s advisories. Regular updates mitigate the vulnerability.

Workarounds

If patching is not immediately possible, consider disabling DNS Security in critical environments.

bash

# Configuration example
set network services dns-security disable
commit