CVE-2024-32761
π TL;DR
This CVE describes a data leak vulnerability in F5 BIG-IP Traffic Management Microkernels (TMMs) running on VELOS and rSeries platforms. Under certain conditions, it may leak up to 64 bytes of non-contiguous randomized data, and in rare cases could cause TMM restarts affecting availability. Only BIG-IP tenants on VELOS and rSeries platforms running supported software versions are affected.
π» Affected Systems
- F5 BIG-IP Traffic Management Microkernels (TMMs)
β οΈ Risk & Real-World Impact
Worst Case
TMM restart causing service disruption and potential data leakage of sensitive information from memory
Likely Case
Minor data leakage of random memory bytes with minimal security impact
If Mitigated
No impact if proper network segmentation and access controls prevent exploitation
π― Exploit Status
The vulnerability occurs randomly and cannot be deliberately triggered according to the description
π οΈ Fix & Mitigation
β Official Fix
Patch Version: Check F5 advisory K000139217 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000139217
Restart Required: Yes
Instructions:
1. Review F5 advisory K000139217 for affected versions. 2. Upgrade to patched versions as specified in the advisory. 3. Restart TMM services after patching.
π§ Temporary Workarounds
Network segmentation and access controls
allImplement strict network segmentation and access controls to limit exposure of affected systems
π§― If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Monitor for TMM restarts and unusual memory access patterns
π How to Verify
Check if Vulnerable:
Check BIG-IP version and platform type against F5 advisory K000139217Check Version:
tmsh show sys versionVerify Fix Applied:
Verify BIG-IP version is updated to patched version specified in F5 advisoryπ‘ Detection & Monitoring
Log Indicators:
- Unexpected TMM restarts
- Memory access errors in system logs
Network Indicators:
- Unusual traffic patterns to/from TMM services
SIEM Query:
Search for 'TMM restart' or 'memory leak' events in BIG-IP logs