WAD SSL Handshake Buffer Exhaustion during TLS 1.3 Session Resumption
FortiOS proxy worker daemon /bin/wad suffers a continuous heap allocation leak when processing high volumes of TLS 1.3 0-RTT early data and Pre-Shared Key (PSK) session ticket resumptions, ultimately driving the appliance into memory conserve mode.
Technical Root Cause Analysis
When FortiOS proxy-mode firewall policies perform deep SSL inspection on modern web traffic, endpoints negotiating TLS 1.3 leverage PSK tickets to resume sessions without a full round-trip handshake. In FortiOS builds prior to 7.2.6, the WAD SSL engine initializes an ephemeral ring buffer ssl_session_ticket_ctx for each resumption attempt to decrypt the NewSessionTicket extension and replay early 0-RTT application payloads.
During rapid connection reconnect bursts—frequent with modern browsers, microservices, and mobile applications—the session ticket validator overwrites the session pointer before calling the inner deallocation macro wad_ssl_ticket_free(). As a result, 4KB to 16KB user-space heap chunks are orphaned per resumption. Over several hours or days, active WAD worker memory footprints expand monotonically until system memory breaches the 82% conserve mode threshold.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.1 – 7.2.5 | 7.2.6+ | Restrict SSL profile to TLS 1.2 or disable ticket resumption |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgrade to 7.4.2 GA or apply protocol options fallback |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | TLS 1.3 0-RTT resumption handler uses legacy static cache |
Platform Impact: Affects FortiGate 60F, 80F, 100F, 200F, and 400F appliances running proxy inspection with deep SSL inspection under high concurrent user loads.
Step 01: Free Verification CLI (Safe Read-Only)
Run these diagnostic commands to determine if WAD workers are leaking memory and identify whether conserve mode is imminent:
Diagnostic Commands
# 1. Inspect per-worker memory allocations inside the WAD daemon
diagnose test application wad 1000
# 2. View top memory-consuming processes to isolate leaking WAD workers
diagnose sys top-mem 10
# 3. Query active SSL session cache size and ticket resumption stats
diagnose test application wad 110
# 4. Check whether the firewall has entered conserve mode
diagnose hardware sysinfo conserveRemediation & Workaround Steps (Teaser Preview)
Access the complete step-by-step remediation guide in the interactive Ferrite platform:
Frequently Asked Questions
During rapid TLS 1.3 Pre-Shared Key (PSK) session ticket resumption or 0-RTT early data handshakes, WAD proxy workers allocate ephemeral SSL handshake reassembly buffers. When clients negotiate rapid reconnects, the ticket validation callback fails to release the allocated ssl_session_ticket_ctx buffer before overwriting the handle, causing steady heap exhaustion.
Administrators can set 'set ssl-max-proto-ver tls1-2' within the active firewall ssl-ssh-profile or disable session-ticket resumption under firewall ssl-ssh-profile settings. This forces clients to negotiate TLS 1.2 sessions which use clean, isolated session caches without memory leaks.
This defect is permanently resolved in FortiOS 7.2.6, 7.4.2, and later builds, where the TLS 1.3 session ticket deserializer and context release lifecycle were overhauled.