CVE-2024-23314: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2024-23314 Overview

CVE-2024-23314 is a denial-of-service vulnerability affecting F5 BIG-IP and BIG-IP Next Service Proxy for Kubernetes (SPK) systems when HTTP/2 is configured. Undisclosed HTTP/2 responses can cause the Traffic Management Microkernel (TMM) process to terminate, disrupting traffic processing across all virtual servers handled by the affected instance. The flaw is categorized under [CWE-908] (Use of Uninitialized Resource) and is remotely triggerable without authentication or user interaction. F5 notes that software versions which have reached End of Technical Support (EoTS) were not evaluated.

Critical Impact
A remote attacker can terminate the TMM process on BIG-IP devices configured with HTTP/2, causing service interruption to all applications fronted by the affected appliance.

Affected Products

F5 BIG-IP modules (Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, DNS, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager) including version 17.1.0
F5 BIG-IQ Centralized Management
F5 BIG-IP Next Service Proxy for Kubernetes (SPK)

Discovery Timeline

2024-02-14 - CVE-2024-23314 published to NVD
2025-01-23 - Last updated in NVD database

Technical Details for CVE-2024-23314

Vulnerability Analysis

The Traffic Management Microkernel (TMM) is the core data-plane process on F5 BIG-IP appliances, handling all client connections, SSL/TLS termination, load balancing, and policy enforcement. When HTTP/2 is enabled on a virtual server, TMM processes HTTP/2 frames and converts them between the client and back-end origin servers.

A specific class of undisclosed HTTP/2 responses triggers an abnormal condition in TMM, causing the process to terminate. When TMM exits, all traffic transiting the affected BIG-IP instance is interrupted until the process restarts. Repeated triggering produces sustained denial of service.

The issue is remotely reachable over the network at low attack complexity and requires no privileges or user interaction. Impact is limited to availability — confidentiality and integrity are not affected.

Root Cause

F5 has not publicly disclosed the precise responses or code paths involved. The vulnerability is mapped to [CWE-908] (Use of Uninitialized Resource), indicating that TMM likely operates on an uninitialized variable, buffer, or state machine field during HTTP/2 response processing, producing an unrecoverable error.

Attack Vector

Exploitation requires an attacker-influenced HTTP/2 response to traverse an affected BIG-IP virtual server. This is most plausible when BIG-IP acts as a reverse proxy or HTTP/2 client toward back-end services that an adversary can control, manipulate, or compromise. Refer to the F5 Support Article K000137675 for vendor-confirmed exploitation conditions.

No public proof-of-concept code or exploit has been released, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-23314

Indicators of Compromise

Unexpected TMM core dumps or tmm process restarts recorded in /var/log/ltm and /var/log/tmm
Sudden loss of traffic across all virtual servers on a BIG-IP instance followed by automatic recovery
Cluster failover events triggered by data-plane process termination on the active unit
HTTP/2 response anomalies correlated in time with TMM restart events

Detection Strategies

Monitor BIG-IP system logs for TMM panic, segmentation fault, or restart messages and forward them to a centralized SIEM for alerting.
Correlate back-end origin server response patterns with TMM termination events to identify potentially malicious upstream traffic.
Track HTTP/2 connection counts and abrupt drops on virtual servers configured with the HTTP/2 profile.

Monitoring Recommendations

Enable SNMP and syslog forwarding from BIG-IP devices to a centralized logging platform for TMM health metrics.
Configure alerts on tmm restart counters exposed through tmctl and iControl REST endpoints.
Review iHealth diagnostic uploads regularly for TMM core files associated with HTTP/2 processing.

How to Mitigate CVE-2024-23314

Immediate Actions Required

Identify BIG-IP and BIG-IP Next SPK instances with HTTP/2 profiles applied to virtual servers using tmsh list ltm virtual and inventory exposure.
Apply the engineering hotfix or upgrade to a fixed software branch as documented in F5 Support Article K000137675.
Confirm devices are not running End of Technical Support (EoTS) versions, which F5 did not evaluate and will not patch.

Patch Information

F5 has published remediation guidance and fixed software versions in F5 Support Article K000137675. Customers should follow the vendor advisory to identify the fixed release for their specific BIG-IP module and version branch.

Workarounds

Remove the HTTP/2 profile from affected virtual servers if the protocol is not required. This eliminates the vulnerable code path at the cost of HTTP/2 client benefits.
Restrict back-end origin servers to trusted, hardened systems to reduce the likelihood that attacker-controlled HTTP/2 responses reach TMM.
Where supported, terminate HTTP/2 at an upstream device and proxy HTTP/1.1 to the BIG-IP until patching is complete.

bash

# List virtual servers with HTTP/2 profiles attached
tmsh list ltm virtual one-line | grep -i http2

# Detach the HTTP/2 profile from a specific virtual server as a workaround
tmsh modify ltm virtual <virtual_server_name> profiles delete { http2 }
tmsh save sys config