CVE-2021-23048
📋 TL;DR
This vulnerability in F5 BIG-IP systems allows remote attackers to cause denial of service by sending specially crafted GTP messages to virtual servers configured with GTP iRules commands or GTP profiles. The attack causes the Traffic Management Microkernel (TMM) to terminate, disrupting traffic processing. Affected systems include BIG-IP versions 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for all traffic handled by the affected BIG-IP system, requiring manual intervention to restart services.
Likely Case
Denial of service affecting GTP traffic specifically, with potential cascading effects on dependent services.
If Mitigated
Minimal impact if GTP features are not configured or if systems are behind proper network segmentation.
🎯 Exploit Status
Exploitation requires sending specific GTP messages to vulnerable configurations. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1
Vendor Advisory: https://support.f5.com/csp/article/K19012930
Restart Required: Yes
Instructions:
1. Download appropriate patch from F5 Downloads. 2. Backup configuration. 3. Apply patch following F5 upgrade procedures. 4. Restart system to activate fix.
🔧 Temporary Workarounds
Disable GTP configurations
allRemove GTP iRules commands and GTP profiles from virtual servers to eliminate attack surface.
tmsh list ltm virtual <virtual_server_name> | grep -i gtp
tmsh modify ltm virtual <virtual_server_name> { profiles remove { gtp } }
tmsh modify ltm virtual <virtual_server_name> { rules remove { <gtp_irule> } }
Network segmentation
allRestrict access to GTP-configured virtual servers using firewall rules or network ACLs.
🧯 If You Can't Patch
- Disable GTP features on all virtual servers immediately
- Implement strict network controls to limit GTP traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version with 'tmsh show sys version' and verify if GTP configurations exist using 'tmsh list ltm virtual all | grep -i gtp'Check Version:
tmsh show sys versionVerify Fix Applied:
Confirm version is patched with 'tmsh show sys version' and verify no TMM crashes occur after applying patch and restarting.📡 Detection & Monitoring
Log Indicators:
- TMM process termination/crash logs in /var/log/ltm
- Unexpected service restarts in system logs
Network Indicators:
- Unusual GTP traffic patterns to BIG-IP systems
- Sudden loss of connectivity to GTP-configured services
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR source="/var/log/messages" AND "bigd" AND "restarting"