CVE-2024-40764: SonicWall SonicOS DoS Vulnerability

CVE-2024-40764 Overview

CVE-2024-40764 is a heap-based buffer overflow vulnerability in the SonicOS IPSec VPN component. An unauthenticated remote attacker can exploit the flaw over the network to trigger a Denial of Service (DoS) condition on affected SonicWall firewalls. The vulnerability is tracked under [CWE-122] (Heap-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write).

The issue affects a broad range of SonicWall hardware appliances and virtual firewalls, including the TZ, NSa, NSsp, and NSv product families. Because the IPSec VPN service is typically exposed to the internet, the attack surface for this flaw is substantial.

Critical Impact

Successful exploitation crashes the SonicOS firewall service, disrupting VPN connectivity and network traffic enforcement for all users behind the affected device.

Affected Products

• SonicWall SonicOS (multiple versions)
• SonicWall TZ series: TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570P, TZ570W, TZ670
• SonicWall NSa series (2700, 3700, 4700, 5700, 6700) and NSsp series (10700, 11700, 13700, 15700)
• SonicWall NSv virtual firewalls (NSv10, NSv25, NSv50, NSv100, NSv200, NSv270, NSv300, NSv400, NSv470, NSv800, NSv870, NSv1600)

Discovery Timeline

• 2024-07-18 - CVE-2024-40764 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-40764

Vulnerability Analysis

The vulnerability resides in the IPSec VPN handler within SonicOS. The code path allocates a heap buffer and writes attacker-controlled data into it without correctly validating size constraints. This out-of-bounds write corrupts adjacent heap metadata or structures, leading to a process crash.

Because the affected component is the IPSec VPN service, exploitation does not require authentication or user interaction. The attacker only needs network reachability to the IKE/IPSec listener, which is typically the WAN interface. The EPSS score of 10.163% (93rd percentile) indicates elevated exploitation likelihood relative to most CVEs.

Root Cause

The root cause is insufficient bounds checking when parsing or copying IPSec VPN protocol data into a heap-allocated buffer. CWE-122 and CWE-787 classifications confirm both the heap location and the out-of-bounds write primitive. SonicWall's advisory does not disclose the specific protocol field or function, but heap corruption in IPSec parsers typically involves malformed IKE payloads or oversized attribute fields.

Attack Vector

An attacker sends crafted IPSec VPN packets to the WAN-facing IKE service on UDP port 500 or 4500. The malformed payload triggers the over-sized write during processing, corrupting heap structures. The result is a crash of the SonicOS process, terminating active VPN tunnels and disrupting firewall operations until the device recovers or reboots. No exploit code is publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the SonicWall Vulnerability Advisory SNWLID-2024-0012 for vendor-supplied technical details.

Detection Methods for CVE-2024-40764

Indicators of Compromise

• Unexpected reboots or service restarts on SonicWall firewall appliances
• IPSec VPN tunnels dropping simultaneously across multiple peers
• SonicOS crash dumps or kernel panic events in device logs
• Inbound IKE/IPSec traffic from untrusted sources preceding device instability

Detection Strategies

• Monitor SonicOS event logs for repeated IPSec process crashes or watchdog-triggered reboots
• Inspect netflow or firewall telemetry for anomalous UDP/500 and UDP/4500 traffic patterns from external IPs
• Correlate VPN tunnel failure events with inbound IKE traffic spikes to identify probing attempts
• Forward firewall syslog data to a centralized SIEM and alert on repeated daemon restarts

Monitoring Recommendations

• Enable syslog forwarding from all SonicWall devices to a centralized logging platform
• Track availability metrics and uptime baselines for IPSec VPN services
• Deploy network IDS signatures for malformed IKE payloads where feasible
• Alert on inbound IPSec connection attempts from IP addresses outside expected partner ranges

How to Mitigate CVE-2024-40764

Immediate Actions Required

• Apply the SonicOS firmware updates published in SonicWall Advisory SNWLID-2024-0012
• Inventory all SonicWall TZ, NSa, NSsp, and NSv devices and validate firmware versions against the advisory
• Restrict IPSec VPN access to known peer IP addresses using WAN access rules where operationally feasible
• Subscribe to SonicWall PSIRT notifications to receive future advisories promptly

Patch Information

SonicWall has released fixed SonicOS firmware versions documented in advisory SNWLID-2024-0012. Administrators should consult the advisory for the exact patched versions corresponding to each hardware and virtual appliance model, then schedule firmware upgrades during maintenance windows.

Workarounds

• Where patching cannot be performed immediately, restrict IPSec VPN connectivity to specific trusted source IP ranges via WAN access policies
• Disable the IPSec VPN service on devices that do not require it
• Place SonicWall management and VPN interfaces behind upstream filtering that drops malformed IKE traffic

# Example: restrict IPSec VPN access to trusted peer addresses
# Configure WAN access rules on SonicOS to allow IKE/IPSec only from defined peers
# Source: replace with your trusted peer address objects
# Service: IKE (UDP 500), IPSec NAT-T (UDP 4500)
# Action: Allow from TrustedPeers -> WAN, Deny from Any -> WAN for IKE/NAT-T