F5 BIG-IP IPsec Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP systems when IPsec is configured. Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, disrupting traffic until the TMM process restarts. This issue allows a remote, unauthenticated attacker to cause a DoS on the BIG-IP system, affecting only the data plane.

Impact

Exploitation of this vulnerability disrupts traffic by causing the TMM process to terminate and restart, leading to a temporary denial-of-service condition on the BIG-IP system.

Remediation

Users can upgrade to a fixed version. For BIG-IP Next CNF and BIG-IP Next for Kubernetes, the fixed version is 2.1.0-EHF-1. For BIG-IP, the fixed versions are 17.5.1, 17.1.3, 16.1.6.1, and 15.1.10.8. F5 recommends configuring BIG-IP systems with high availability to lessen the impact of this vulnerability.