F5 BIG-IP AFM CPU Resource Exhaustion Vulnerability Leading to Denial-of-Service

A vulnerability exists in F5 BIG-IP Application Firewall Manager (AFM) when the Intrusion Prevention System (IPS) module is active and a protocol inspection profile is applied to a virtual server, firewall rule, or policy. Under these conditions, certain undisclosed traffic can cause a significant increase in CPU usage. This CPU exhaustion can degrade system performance, potentially causing the Traffic Management Microkernel (TMM) process to crash or require a manual restart. The issue represents a data plane problem, with no exposure to the control plane.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition on the BIG-IP system, causing the TMM process to become unresponsive and requiring a restart.

Remediation

Users can upgrade to BIG-IP versions 17.1.2, 16.1.6, or 15.1.10.6.0.11.6 to address this vulnerability. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.