SonicWall SonicOS: stack overflow via SessionID HTTP header, DoS and possible code execution

Impact

An authenticated attacker can overflow a stack buffer through the SessionID HTTP response header. That crashes the firewall and may give code execution on it. Taking over a segmentation or perimeter firewall puts the attacker in the path of management and tenant traffic. SonicOS Gen 5, Gen 6 and Gen 7 are affected. This is a different code path and advisory from CVE-2021-20046.

Who can reach it

Remote, but it needs an authenticated session on the firewall's HTTP interface.

What to do

Upgrade SonicOS to the fixed firmware in SNWLID-2021-0028. That is a firewall firmware upgrade and reboot, or a failover to an HA peer. Limit management interface access to trusted hosts.

References

Related entries

• Cisco NX-OS / FXOS (Cisco Discovery Protocol): Root code execution on the switch from a crafted CDP frame sentCVE-2022-20824 · Cisco NX-OS / FXOS (Cisco Discovery Protocol)High
• HPE iLO 5 (adjacent-network code execution / DoS): Arbitrary code execution on the iLO from an adjacent networkCVE-2022-28639 · HPE iLO 5 (adjacent-network code execution / DoS)High
• Intel Server Platform Services (SPS) firmware: Active debug code left enabled in shipped SPS firmware letsCVE-2022-36348 · Intel Server Platform Services (SPS) firmwareHigh
• Linux kernel (drivers/infiniband/hw/hfi1): The node panics when the fabric link goes down while any sender is waitingCVE-2022-49931 · Linux kernel (drivers/infiniband/hw/hfi1)High
• SonicWall SonicOS SSLVPN: no limit on MFA code attemptsCVE-2023-1101 · SonicWall SonicOS (SSLVPN MFA)High
• Insyde InsydeH2O (IhisiSmm SMI handler): A malicious host OS calls an Insyde SMI handler with malformed argumentsCVE-2023-22612 · Insyde InsydeH2O (IhisiSmm SMI handler)High