CVE-2023-22842
📋 TL;DR
This vulnerability affects F5 BIG-IP systems with specific configurations, causing the Traffic Management Microkernel (TMM) to crash when processing certain SIP traffic. Systems running affected versions with SIP profiles configured on Message Routing type virtual servers are vulnerable. The crash leads to denial of service, disrupting network traffic processing.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption as TMM crashes, causing all traffic processing to stop until system restart, potentially affecting multiple services.
Likely Case
Intermittent service outages as TMM crashes under specific SIP traffic conditions, requiring manual intervention to restore services.
If Mitigated
Minimal impact if systems are patched or SIP profiles are not configured on Message Routing virtual servers.
🎯 Exploit Status
Exploitation requires sending specific SIP traffic to vulnerable configuration. No authentication needed if network access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.3.3, 15.1.8.1, 14.1.5.3
Vendor Advisory: https://my.f5.com/manage/s/article/K08182564
Restart Required: Yes
Instructions:
1. Download appropriate patch version from F5 Downloads. 2. Upload to BIG-IP system. 3. Install using tmsh commands: 'tmsh install sys software' 4. Reboot system after installation completes.
🔧 Temporary Workarounds
Remove SIP Profile Configuration
allRemove SIP profile from Message Routing type virtual servers to eliminate vulnerability
tmsh modify ltm virtual <virtual_server_name> profiles delete { sip }
Network Segmentation
allRestrict SIP traffic to vulnerable virtual servers using firewall rules or network ACLs
🧯 If You Can't Patch
- Remove SIP profiles from all Message Routing type virtual servers
- Implement network controls to block or filter SIP traffic to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check if running affected version: 'tmsh show sys version' and verify if SIP profile is configured on Message Routing virtual servers: 'tmsh list ltm virtual one-line'Check Version:
tmsh show sys version | grep VersionVerify Fix Applied:
Verify version is patched: 'tmsh show sys version' shows 16.1.3.3, 15.1.8.1, or 14.1.5.3 or higher📡 Detection & Monitoring
Log Indicators:
- TMM crash logs in /var/log/ltm
- System logs showing TMM process termination
- High availability failover events
Network Indicators:
- Unusual SIP traffic patterns to Message Routing virtual servers
- Service disruption coinciding with SIP traffic spikes
SIEM Query:
source="BIG-IP" AND ("TMM terminated" OR "TMM crash" OR "failover event")