CVE-2024-21771
📋 TL;DR
This vulnerability in F5 BIG-IP AFM IPS engine causes denial of service when processing specific traffic patterns. The IPS engine spends excessive time matching traffic against signatures, triggering TMM restarts and traffic disruption. Affects F5 BIG-IP systems with AFM module enabled.
💻 Affected Systems
- F5 BIG-IP with AFM module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete traffic disruption across all BIG-IP services due to repeated TMM restarts, leading to extended service outages.
Likely Case
Intermittent traffic disruption and service instability during periods of specific traffic patterns.
If Mitigated
Minimal impact with proper traffic filtering and monitoring in place to detect and block triggering patterns.
🎯 Exploit Status
Exploitation requires sending specific traffic patterns that trigger the signature matching issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000137595 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000137595
Restart Required: Yes
Instructions:
1. Review F5 advisory K000137595. 2. Identify affected version. 3. Upgrade to fixed version per F5 documentation. 4. Restart TMM services.
🔧 Temporary Workarounds
Disable AFM IPS Engine
allTemporarily disable the AFM IPS engine to prevent the vulnerability from being triggered
tmsh modify security firewall dos-device-config dos-device-config-name <name> ip-intelligence enabled no
Limit IPS Signature Matching
allReduce IPS signature set to minimize processing time
tmsh modify security firewall dos-device-config dos-device-config-name <name> ip-intelligence enabled no
🧯 If You Can't Patch
- Implement network filtering to block suspicious traffic patterns
- Monitor TMM restart logs and implement alerting for abnormal patterns
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version and compare against affected versions in F5 advisory K000137595Check Version:
tmsh show sys versionVerify Fix Applied:
Verify upgraded version matches fixed versions in advisory and monitor for TMM restarts📡 Detection & Monitoring
Log Indicators:
- TMM restart events in /var/log/ltm
- High CPU usage by IPS engine processes
- Traffic disruption logs
Network Indicators:
- Unusual traffic patterns targeting BIG-IP AFM
- Increased latency or packet loss
SIEM Query:
source="*/var/log/ltm*" AND "TMM restart" OR "traffic disruption"