CVE-2024-3382: 
PAN-OS vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2024-3382) exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This vulnerability specifically affects PA-5400 Series devices running PAN-OS software with the SSL Forward Proxy feature enabled. The vulnerability was discovered in production use and was disclosed on April 10, 2024 (PAN Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the following characteristics: Network attack vector, High attack complexity, Present attack requirements, No user interaction required, and High availability impact. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-401 (Missing Release of Memory after Effective Lifetime). The affected versions include PAN-OS versions prior to 10.2.7-h3, 11.0.4, and 11.1.2 (PAN Advisory, NVD).

When successfully exploited, this vulnerability can lead to a denial of service condition where the firewall becomes unable to process traffic. The impact is specifically limited to PA-5400 Series devices with SSL Forward Proxy feature enabled, potentially affecting critical network infrastructure and causing service disruption (PAN Advisory).

The vulnerability requires sending a burst of crafted packets through the firewall. Palo Alto Networks has indicated they are not aware of any malicious exploitation of this issue in the wild (PAN Advisory).

The vulnerability has been fixed in PAN-OS versions 10.2.7-h3, 11.0.4, 11.1.2, and all later PAN-OS versions. As a workaround, administrators can mitigate this issue by disabling decryption on their firewalls. To temporarily disable SSL Decryption, administrators should refer to their specific PAN-OS administrator's guide. Additionally, to ensure decryption remains disabled after a reboot, it's recommended to configure a policy-based decryption exclusion that excludes all traffic from being decrypted (PAN Advisory).