A Vulnerability in F5Networks BIG-IP Could Allow for Denial of Service

ITS Advisory Number: 
2022-013
Date(s) Issued: 
Tuesday, January 25, 2022
Subject: 
A Vulnerability in F5Networks BIG-IP Could Allow for Denial of Service
Overview: 

A vulnerability has been discovered in F5Networks BIG-IP, which could result in a denial-of-service (DoS). BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions. Successful exploitation of this vulnerability could allow an attacker to cause a denial of service to all servers sitting behind the BIG-IP system.

 

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being exploited in the wild.

Systems Affected: 
  • F5 BIG-IP 12.1.6
  • F5 BIG-IP 13.1.4
  • F5 BIG-IP 14.1.0
  • F5 BIG-IP 14.1.2.8
  • F5 BIG-IP 14.1.3
  • F5 BIG-IP 14.1.3.1
  • F5 BIG-IP 14.1.4
  • F5 BIG-IP 14.1.4.2
  • F5 BIG-IP 14.1.4.3
  • F5 BIG-IP 15.1.0
  • F5 BIG-IP 15.1.0.5
  • F5 BIG-IP 15.1.2
  • F5 BIG-IP 15.1.3
  • F5 BIG-IP 15.1.3.1
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
Medium
BUSINESS
Large and medium business entities: 
High
Small business entities: 
Medium
Home Users: 
Low
Description: 

A vulnerability has been discovered in F5Networks BIG-IP, which could result in a denial-of-service (DoS). This vulnerability exists when a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, and undisclosed requests are received which can cause the virtual server to stop processing new client connections (CVE-2022-23027). Although this is a non-default configuration, FastL4 is a layer 4 profile to increase performance so having a FastL4 profile and a HTTP profile is likely not uncommon in deployments. The virtual server is utilized as a way to route connection over a certain port to specific servers so if the virtual server for port 80 or 443 was affected successful exploitation of this vulnerability could cause the impacted system to not allow any new client connections to webservers. Successful exploitation of this vulnerability could allow an attacker to cause a denial of service to all servers sitting behind the BIG-IP system.

Actions: 
  • After appropriate testing, immediately apply patches or mitigations provided by F5 to vulnerable systems.
  • Deploy network intrusion detection systems to monitor network traffic to affected devices.