CVE-2021-23045
📋 TL;DR
This vulnerability in F5 BIG-IP systems allows remote attackers to cause denial of service by sending specially crafted SCTP requests to virtual servers configured with SCTP profiles using multiple paths. The Traffic Management Microkernel (TMM) terminates, disrupting traffic processing. Affected organizations are those running vulnerable BIG-IP versions with SCTP multi-path configurations.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for all traffic handled by the affected BIG-IP system, requiring manual intervention to restart services.
Likely Case
Intermittent service outages affecting SCTP traffic flows, with automatic TMM restarts causing temporary disruptions.
If Mitigated
Minimal impact if SCTP multi-path configurations are not used or if systems are patched/isolated.
🎯 Exploit Status
Exploitation requires sending undisclosed SCTP requests to vulnerable configurations. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1
Vendor Advisory: https://support.f5.com/csp/article/K94941221
Restart Required: Yes
Instructions:
1. Download appropriate patch from F5 Downloads. 2. Upload to BIG-IP system. 3. Install using tmsh or WebUI. 4. Reboot system to complete installation.
🔧 Temporary Workarounds
Disable SCTP multi-path configurations
allRemove or modify SCTP profiles to use single path configurations instead of multiple paths.
tmsh modify ltm profile sctp <profile_name> multipath disabled
Remove SCTP virtual servers
allDisable or remove virtual servers using SCTP profiles with multiple paths.
tmsh delete ltm virtual <virtual_server_name>
🧯 If You Can't Patch
- Implement network segmentation to restrict SCTP traffic to trusted sources only.
- Deploy intrusion prevention systems (IPS) with SCTP anomaly detection capabilities.
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version with 'tmsh show sys version' and verify if any virtual servers use SCTP profiles with multipath enabled using 'tmsh list ltm virtual' and 'tmsh list ltm profile sctp'.Check Version:
tmsh show sys versionVerify Fix Applied:
Confirm version is patched with 'tmsh show sys version' and verify no SCTP profiles have multipath enabled on production virtual servers.📡 Detection & Monitoring
Log Indicators:
- TMM process termination logs in /var/log/ltm
- Unexpected BIG-IP service restarts
- SCTP connection errors
Network Indicators:
- Unusual SCTP traffic patterns to BIG-IP systems
- Service disruption on SCTP-enabled virtual servers
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR "SCTP" AND "error"