F5 BIG-IP and BIG-IP Next CNF DNS Cache Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP and BIG-IP Next CNF virtual servers with DNS cache enabled. Undisclosed DNS queries can lead to increased memory usage, causing system performance to degrade. This issue affects several different versions and branches of BIG-IP, while BIG-IQ Centralized Management is not vulnerable.

Impact

Exploitation of this vulnerability can degrade system performance, causing the Traffic Management Microkernel (TMM) process to crash or require a manual restart. This issue leads to a denial-of-service condition on the BIG-IP system.

Remediation

Users can upgrade to versions 17.1.2.2, 16.1.6, or 15.1.10.8, depending on their current BIG-IP version. For BIG-IP Next CNF, no specific version is listed, but users should consult F5's guidance on managing product hotfixes. F5 also recommends configuring BIG-IP systems with high availability to mitigate the impact of this vulnerability.