SonicWall SonicOS: authenticated requests to several web endpoints overflow the stack and crash the firewall

CVSS 6.5CVE-2023-39276Firmware, BMC & network fabric+6 more CVEscurated

Impact

SonicWall split this across 7 CVE ids, one per affected URL endpoint: getBookmarkList.json, sonicflow.csv and appflowsessions.csv, main.cgi, getPacketReplayData.json, ssoStats-s.xml/.wri, sonicwall.exp/prefs.exp, and the SSL VPN plainprefs.exp. In each, an authenticated request causes a stack-based buffer overflow that crashes the firewall. The stated result is denial of service: a crashed edge firewall or NSv instance cuts off everything behind it, including remote management of the GPU fleet and any tenant traffic it carries. The records describe a crash only, not code execution.

Who can reach it

Any authenticated user who can reach the SonicOS web interface, or the SSL VPN portal for CVE-2023-41712, over the network. Authentication is required; no user interaction.

What to do

Upgrade SonicOS to the fixed release in SonicWall advisory SNWLID-2023-0012, the same advisory and fix for all 7 ids; the record does not name the version. The upgrade reboots the appliance, so fail over an HA pair or schedule a window. Until then, restrict management and SSL VPN portal access to trusted networks and accounts.

Also covers 6 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2023-39277CVE-2023-39278CVE-2023-39279CVE-2023-39280CVE-2023-41711CVE-2023-41712

References

https://nvd.nist.gov/vuln/detail/CVE-2023-39276 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.