CVE-2024-46670: Fortinet FortiOS DOS Vulnerability

CVE-2024-46670 Overview

CVE-2024-46670 is an Out-of-bounds Read vulnerability (CWE-125) affecting Fortinet FortiOS and FortiSASE FortiOS tenant deployments. The vulnerability exists in the IPsec IKE service, where improper boundary checks allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service conditions through specially crafted network requests.

Critical Impact
Unauthenticated attackers can remotely cause Denial of Service on FortiOS firewalls by exploiting the IPsec IKE service, potentially disrupting VPN connectivity and network security operations for affected organizations.

Affected Products

FortiOS version 7.6.0
FortiOS version 7.4.4 and below
FortiOS version 7.2.9 and below
FortiSASE FortiOS tenant version 24.3.b

Discovery Timeline

2025-01-14 - CVE-2024-46670 published to NVD
2025-01-31 - Last updated in NVD database

Technical Details for CVE-2024-46670

Vulnerability Analysis

This Out-of-bounds Read vulnerability affects the IPsec Internet Key Exchange (IKE) service in FortiOS. The vulnerability allows remote attackers to read memory beyond the intended buffer boundaries during IKE protocol processing. When exploited, the out-of-bounds read operation causes excessive memory consumption rather than information disclosure, ultimately leading to service disruption.

The attack can be executed without any authentication requirements over the network, making it particularly dangerous for internet-facing FortiOS deployments with IPsec VPN services enabled. Organizations relying on Fortinet devices for site-to-site VPN or remote access VPN are at risk of service disruption.

Root Cause

The root cause lies in improper bounds checking within the IPsec IKE service implementation. When processing incoming IKE protocol messages, the service fails to properly validate the length or boundaries of certain data structures before reading memory. This allows crafted packets to trigger read operations that extend beyond allocated buffer boundaries, causing the system to consume excessive memory resources as it processes the malformed data.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can target the IPsec IKE service (typically UDP ports 500 and 4500) by sending specially crafted IKE protocol packets. The exploitation does not require the attacker to have valid VPN credentials or any prior access to the system. The crafted requests trigger the out-of-bounds read condition, which causes memory consumption that degrades service availability and can lead to complete denial of service for the affected FortiOS device.

The attack affects the availability of the system without impacting confidentiality or integrity, as the vulnerability causes resource exhaustion rather than data leakage or unauthorized modifications.

Detection Methods for CVE-2024-46670

Indicators of Compromise

Unusual memory consumption spikes on FortiOS devices, particularly associated with the IKE daemon
High volume of malformed or anomalous IKE packets targeting UDP ports 500 or 4500
IPsec VPN service instability or repeated service restarts
System logs indicating IKE service crashes or memory allocation failures

Detection Strategies

Monitor FortiOS system resource utilization for abnormal memory consumption patterns
Implement network intrusion detection rules to identify malformed IKE protocol packets
Configure alerting on FortiOS diagnostic logs for IKE daemon errors or crash events
Deploy packet capture analysis at network boundaries to detect anomalous IKE traffic patterns

Monitoring Recommendations

Enable detailed logging for IPsec IKE service events on affected FortiOS devices
Configure SNMP or syslog monitoring for memory utilization thresholds
Implement network flow analysis to baseline normal IKE traffic and detect anomalies
Review FortiOS crash logs and diagnostic output regularly for signs of exploitation attempts

How to Mitigate CVE-2024-46670

Immediate Actions Required

Review the Fortinet Security Advisory FG-IR-24-266 for vendor-specific guidance
Identify all FortiOS deployments running vulnerable versions (7.6.0, 7.4.4 and below, 7.2.9 and below)
Prioritize patching internet-facing FortiOS devices with IPsec VPN services enabled
Consider implementing rate limiting on IKE traffic at network boundaries as a temporary measure

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should upgrade to patched versions of FortiOS as specified in the official Fortinet Security Advisory FG-IR-24-266. Contact Fortinet support or consult the advisory for specific version upgrade paths based on your current deployment.

Workarounds

If IPsec VPN services are not required, consider disabling the IKE service until patches can be applied
Implement network access control lists (ACLs) to restrict IKE service access to known, trusted IP addresses
Deploy network-based rate limiting for UDP ports 500 and 4500 to reduce exploitation impact
Monitor affected devices closely and be prepared to restart services if degradation is detected

bash

# Example: Review FortiOS version and IKE service status
# Connect to FortiOS CLI and verify current firmware version
get system status

# Check IPsec VPN configuration status
show vpn ipsec phase1-interface

# Review IKE daemon diagnostics
diagnose vpn ike gateway list