F5 BIG-IP and BIG-IQ Uncontrolled Resource Consumption Vulnerability Leading to Denial-of-Service

A vulnerability exists in F5 BIG-IP systems with Client SSL or Server SSL profiles configured on a Virtual Server, or where DNSSEC signing operations are active. Undisclosed traffic can cause excessive memory and CPU usage, degrading system performance. This issue affects BIG-IP versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.5, and 17.1.0 to 17.1.1. The vulnerability allows a remote, unauthenticated attacker to disrupt services, potentially causing a denial-of-service condition on the BIG-IP system.

Impact

Exploitation of this vulnerability leads to a degradation of system performance, causing the Traffic Management Microkernel (TMM) process to either crash or require a manual restart. This issue creates a denial-of-service condition on the affected BIG-IP system.

Remediation

F5 has released engineering hotfixes for this vulnerability. These hotfixes can be downloaded from the MyF5 Downloads page. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.