CVE-2024-23979
📋 TL;DR
This vulnerability affects F5 BIG-IP systems configured with SSL Client Certificate LDAP or CRLDP authentication profiles. When exploited, it causes excessive CPU utilization through undisclosed requests, potentially leading to denial of service. Systems running affected F5 software versions with these specific authentication profiles are vulnerable.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service due to CPU exhaustion, rendering the virtual server unavailable and disrupting application traffic.
Likely Case
Degraded performance and intermittent service disruptions due to high CPU usage affecting application responsiveness.
If Mitigated
Minimal impact with proper rate limiting, monitoring, and network segmentation in place.
🎯 Exploit Status
Undisclosed requests can trigger the vulnerability, suggesting relatively simple exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000134516 for specific fixed versions.
Vendor Advisory: https://my.f5.com/manage/s/article/K000134516
Restart Required: Yes
Instructions:
1. Review F5 advisory K000134516 for affected versions. 2. Upgrade to a fixed version as specified in the advisory. 3. Restart the BIG-IP system to apply the patch.
🔧 Temporary Workarounds
Remove vulnerable authentication profiles
allDisable or remove SSL Client Certificate LDAP and CRLDP authentication profiles from virtual servers.
tmsh modify ltm virtual <virtual_server_name> profiles delete { <profile_name> }
Implement rate limiting
allConfigure rate limiting policies to restrict request frequency to vulnerable authentication endpoints.
tmsh create ltm policy rate-limit-policy rules add { rule1 { actions { 0 { rate-limit discard } } conditions { 0 { http-uri path starts-with "/auth-endpoint" } } } }
🧯 If You Can't Patch
- Remove or disable SSL Client Certificate LDAP and CRLDP authentication profiles from all virtual servers.
- Implement network segmentation and firewall rules to restrict access to affected virtual servers.
🔍 How to Verify
Check if Vulnerable:
Check if SSL Client Certificate LDAP or CRLDP authentication profiles are configured: tmsh list ltm virtual one-line | grep -E "(client-ssl-ldap|crldp)"Check Version:
tmsh show sys versionVerify Fix Applied:
Verify the BIG-IP version is updated to a fixed version per F5 advisory and that vulnerable profiles are removed.📡 Detection & Monitoring
Log Indicators:
- Unusual spikes in CPU utilization logs
- Increased authentication failure logs from LDAP/CRLDP endpoints
Network Indicators:
- High volume of requests to authentication endpoints
- Unusual traffic patterns to virtual servers with these profiles
SIEM Query:
source="bigip_logs" AND ("client-ssl-ldap" OR "crldp") AND cpu_utilization > 90