CVE-2025-47148
📋 TL;DR
This vulnerability affects BIG-IP systems configured as both SAML service provider and identity provider with single logout enabled. Undisclosed requests can cause memory exhaustion, potentially leading to denial of service. Only systems with specific SAML SLO configurations are affected.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to memory exhaustion, disrupting all services running on the BIG-IP device
Likely Case
Degraded performance or intermittent service disruptions as memory resources become constrained
If Mitigated
Minimal impact with proper monitoring and resource limits in place
🎯 Exploit Status
Requires knowledge of SAML protocol and specific BIG-IP configuration. No public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check K000148816 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000148816
Restart Required: No
Instructions:
1. Review K000148816 for applicable fixed versions. 2. Upgrade to recommended version. 3. Verify SAML SLO configuration remains functional.
🔧 Temporary Workarounds
Disable SAML Single Logout
allTemporarily disable single logout functionality in SAML access policies
Navigate to Access > Federation > SAML Service Provider > [your SP] > Single Logout Settings > Disable
Implement Rate Limiting
allApply rate limiting to SAML endpoints to prevent request flooding
Configure rate limiting policies on virtual servers hosting SAML services
🧯 If You Can't Patch
- Disable SAML single logout functionality in affected access policies
- Implement strict network controls to limit access to SAML endpoints
🔍 How to Verify
Check if Vulnerable:
Check if BIG-IP is configured as both SAML SP and IdP with SLO enabled: Access > Federation > SAML configurationsCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify version is updated to fixed release and monitor memory utilization during SAML operations📡 Detection & Monitoring
Log Indicators:
- Unusual memory utilization spikes
- SAML SLO request patterns
- System log warnings about memory pressure
Network Indicators:
- High volume of SAML protocol traffic to SLO endpoints
- Unusual request patterns to /saml endpoints
SIEM Query:
source="bigip_logs" AND ("memory high" OR "SAML SLO" OR "resource exhaustion")