F5 BIG-IP PEM iRules Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP PEM when iRules are applied to a virtual server. This issue arises from certain iRule commands related to traffic classification and URL query manipulation. Under specific, undisclosed traffic conditions, this vulnerability can cause the Traffic Management Microkernel (TMM) to crash, disrupting service until the process is restarted.

Impact

Exploitation of this vulnerability leads to a crash of the Traffic Management Microkernel (TMM), causing a disruption in service while the process restarts. This issue allows a remote, unauthenticated attacker to cause a denial-of-service condition on the BIG-IP system, affecting only the data plane.

Remediation

Users can upgrade to BIG-IP versions 21.0.0.1, 17.5.1.4, or 17.1.3.1 to address this vulnerability. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.