CVE-2022-23024
📋 TL;DR
This vulnerability in F5 BIG-IP AFM's IPsec ALG logging profile causes the Traffic Management Microkernel (TMM) to terminate when processing specific IPsec traffic. This leads to denial of service for affected virtual servers. Organizations running vulnerable BIG-IP AFM versions with IPsec ALG logging configured are affected.
💻 Affected Systems
- F5 BIG-IP Advanced Firewall Manager (AFM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for all traffic handled by the affected virtual server, requiring manual intervention to restart TMM.
Likely Case
Intermittent service outages affecting IPsec traffic processing, potentially impacting VPN connectivity and network security functions.
If Mitigated
Minimal impact if IPsec ALG logging is disabled or systems are patched, with only specific malformed IPsec packets causing issues.
🎯 Exploit Status
Exploitation requires sending specific IPsec traffic to vulnerable systems, but exact packet details are undisclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.0, 15.1.4.1, 14.1.4.2
Vendor Advisory: https://support.f5.com/csp/article/K54892865
Restart Required: Yes
Instructions:
1. Download appropriate patch version from F5 Downloads. 2. Backup configuration. 3. Apply patch using F5 upgrade procedures. 4. Restart system to activate fix.
🔧 Temporary Workarounds
Disable IPsec ALG Logging
allRemove IPsec ALG logging profile configuration from affected virtual servers
tmsh modify ltm virtual <virtual_server_name> profiles delete { <ipsec_alg_logging_profile> }
🧯 If You Can't Patch
- Disable IPsec ALG logging on all virtual servers
- Implement network segmentation to limit IPsec traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version with 'tmsh show sys version' and verify if IPsec ALG logging is configured on any virtual serversCheck Version:
tmsh show sys versionVerify Fix Applied:
After patching, verify version is at or above fixed versions and test IPsec traffic processing📡 Detection & Monitoring
Log Indicators:
- TMM termination logs in /var/log/ltm
- IPsec connection failures
- Virtual server state changes
Network Indicators:
- Sudden drops in IPsec tunnel traffic
- Increased retransmission rates on IPsec connections
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR "ipsec" AND "error"