F5 BIG-IP APM Traffic Management Microkernel Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP APM versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.5, and 17.1.0 through 17.1.2. When Network Access is enabled on a BIG-IP APM virtual server, certain undisclosed traffic can lead to the termination of the Traffic Management Microkernel (TMM) process. This disruption causes a temporary outage as the TMM process restarts, allowing remote, unauthenticated attackers to create a denial-of-service condition on the BIG-IP APM system.

Impact

Exploitation of this vulnerability causes the TMM process to terminate, disrupting traffic management and causing a denial-of-service condition on the BIG-IP APM system.

Remediation

Users can upgrade to BIG-IP APM versions 17.1.2.2 or 16.1.6 to address this vulnerability. For those on the 15.x branch, no update candidate is currently available, but F5 recommends upgrading to a version with the fix. Consult the F5 BIG-IP hotfix and point release matrix for guidance.