CVE-2025-54805
📋 TL;DR
This vulnerability in F5 BIG-IP systems causes memory resource exhaustion in the Traffic Management Microkernel (TMM) when iRules are configured via the declarative API and virtual servers are re-instantiated. This affects BIG-IP systems running vulnerable versions with iRules configured via declarative API. The issue can lead to denial of service conditions.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete TMM memory exhaustion leading to system instability, service disruption, and potential denial of service for all traffic managed by the affected BIG-IP system.
Likely Case
Gradual memory consumption increase causing performance degradation, intermittent connection drops, and reduced system reliability over time.
If Mitigated
Minimal impact with proper monitoring and memory thresholds in place, potentially causing only minor performance fluctuations.
🎯 Exploit Status
Exploitation requires administrative access to configure iRules via declarative API and trigger re-instantiation of virtual servers
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000151596 for fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000151596
Restart Required: No
Instructions:
1. Review F5 advisory K000151596 for affected versions. 2. Upgrade to fixed version per F5 documentation. 3. Verify fix by monitoring TMM memory usage after virtual server re-instantiation.
🔧 Temporary Workarounds
Avoid declarative API for iRules
allConfigure iRules using traditional methods instead of declarative API to prevent the memory leak condition
Limit virtual server re-instantiation
allMinimize configuration changes that trigger virtual server re-instantiation when using declarative API iRules
🧯 If You Can't Patch
- Implement strict change control to minimize virtual server re-instantiation events
- Deploy enhanced monitoring for TMM memory usage with automated alerts for abnormal increases
🔍 How to Verify
Check if Vulnerable:
Check if using declarative API for iRules and monitor TMM memory usage after virtual server re-instantiation eventsCheck Version:
tmsh show sys versionVerify Fix Applied:
After patching, configure iRules via declarative API, trigger virtual server re-instantiation, and verify TMM memory usage remains stable📡 Detection & Monitoring
Log Indicators:
- Increasing TMM memory usage patterns in system logs
- Virtual server re-instantiation events in configuration logs
Network Indicators:
- Increased latency or connection failures through BIG-IP
- Degraded application performance
SIEM Query:
source="bigip_logs" AND ("TMM memory" OR "virtual server re-instantiation")