CVE-2021-3031: PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)

Q: What is CVE-2021-3031?

CVE-2021-3031 is a vulnerability in Palo Alto Networks firewalls that allows for leakage of random information from firewall memory into Ethernet packets due to padding bytes not being cleared.

Q: How severe is CVE-2021-3031?

CVE-2021-3031 has a severity rating of 4.3, which is considered medium.

Q: How can I fix CVE-2021-3031?

To fix CVE-2021-3031, Palo Alto Networks recommends upgrading to PAN-OS version 8.1.18, 9.0.12, or 9.1.5.

Q: Where can I find more information about CVE-2021-3031?

You can find more information about CVE-2021-3031 on the Palo Alto Networks security advisory page: https://security.paloaltonetworks.com/CVE-2021-3031

Published Jan 13, 2021

Updated

Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.

Affected Software

32 affected components

Palo Alto Networks PAN-OS>=8.1.0<8.1.18

Palo Alto Networks PAN-OS>=9.0.0<9.0.12

Palo Alto Networks PAN-OS>=9.1.0<9.1.5

Palo Alto Networks Pa-200

Palo Alto Networks Pa-2020

Palo Alto Networks Pa-2050

Palo Alto Networks Pa-220

Palo Alto Networks Pa-3020

Palo Alto Networks Pa-3050

Palo Alto Networks Pa-3060

Palo Alto Networks Pa-3220

Palo Alto Networks Pa-3250

Palo Alto Networks Pa-3260

Palo Alto Networks Pa-500

Palo Alto Networks Pa-5200

Palo Alto Networks Pa-800

All of the following

Any of the following

Palo Alto Networks PAN-OS>=8.1.0<8.1.18

Palo Alto Networks PAN-OS>=9.0.0<9.0.12

Palo Alto Networks PAN-OS>=9.1.0<9.1.5

Any of the following

Palo Alto Networks Pa-200

Palo Alto Networks Pa-2020

Palo Alto Networks Pa-2050

Palo Alto Networks Pa-220

Palo Alto Networks Pa-3020

Palo Alto Networks Pa-3050

Palo Alto Networks Pa-3060

Palo Alto Networks Pa-3220

Palo Alto Networks Pa-3250

Palo Alto Networks Pa-3260

Palo Alto Networks Pa-500

Palo Alto Networks Pa-5200

Palo Alto Networks Pa-800

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PAN-OS to a version that resolves this vulnerability.
Fixed in 8.1.18
Upgrade
Upgrade PAN-OS to a version that resolves this vulnerability.
Fixed in 9.0.12
Upgrade
Upgrade PAN-OS to a version that resolves this vulnerability.
Fixed in 9.1.5

Event History

Jan 13, 2021

CVE Published

via MITRE·06:10 PM

Data Sourced

via MITRE·06:10 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-3031?

CVE-2021-3031 is a vulnerability in Palo Alto Networks firewalls that allows for leakage of random information from firewall memory into Ethernet packets due to padding bytes not being cleared.

Which products are affected by CVE-2021-3031?

PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are affected by CVE-2021-3031.

How severe is CVE-2021-3031?