CVE-2024-23979: F5 BIG-IP Access Policy Manager DOS Flaw

CVE-2024-23979 Overview

CVE-2024-23979 affects F5 BIG-IP products configured with SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profiles on a virtual server. Undisclosed requests sent to such a virtual server can drive CPU resource utilization upward, degrading availability of the affected device. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). F5 has not evaluated software versions that have reached End of Technical Support (EoTS).

Critical Impact

Remote unauthenticated attackers can exhaust CPU on BIG-IP virtual servers that use SSL Client Certificate LDAP or CRLDP authentication, causing denial of service to load-balanced and proxied applications.

Affected Products

• F5 BIG-IP (Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager) configured with SSL Client Certificate LDAP or CRLDP authentication
• F5 BIG-IP (DNS, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager) including version 17.1.0
• F5 BIG-IQ Centralized Management

Discovery Timeline

• 2024-02-14 - CVE-2024-23979 published to NVD
• 2025-01-23 - Last updated in NVD database

Technical Details for CVE-2024-23979

Vulnerability Analysis

The defect resides in how BIG-IP processes client requests when an authentication profile bound to a virtual server uses SSL Client Certificate LDAP or CRLDP validation. Specific undisclosed requests cause the Traffic Management Microkernel (TMM) to perform expensive certificate validation work without sufficient throttling. Repeated submission of such requests forces sustained high CPU utilization on the data plane.

The weakness aligns with CWE-770, where a resource-intensive operation is reachable from the network without rate limiting or quota enforcement. Because the affected code path executes during certificate revocation checking, the attacker does not need valid credentials or a successful TLS handshake to influence CPU load.

Exploitation results in a denial-of-service condition impacting availability. Confidentiality and integrity of data processed by BIG-IP are not directly affected by this issue.

Root Cause

The root cause is unbounded resource allocation during authentication profile processing. When SSL Client Certificate LDAP or CRLDP is configured, BIG-IP performs CRL retrieval and validation operations triggered by request characteristics that an attacker can manipulate. The absence of throttling on these operations permits an attacker to amplify CPU consumption with relatively low request volume.

Attack Vector

The vulnerability is reachable over the network with no authentication and no user interaction. An attacker sends crafted requests to a BIG-IP virtual server that has an SSL Client Certificate LDAP or CRLDP authentication profile applied. Sustained or volumetric delivery of these requests increases CPU utilization until legitimate traffic is impacted.

F5 has not disclosed the specific request structure that triggers the condition. Refer to the F5 Support Article K000134516 for vendor-supplied technical context.

Detection Methods for CVE-2024-23979

Indicators of Compromise

• Sustained elevated TMM CPU utilization on BIG-IP devices that host virtual servers with SSL Client Certificate LDAP or CRLDP authentication profiles.
• Spikes in CRL fetch operations or LDAP queries from BIG-IP toward configured CRL Distribution Points or LDAP servers without a corresponding increase in legitimate client sessions.
• Connection latency, dropped client connections, or tmm watchdog events coinciding with traffic from a small set of source addresses.

Detection Strategies

• Inventory all BIG-IP virtual servers and identify those with SSL Client Certificate LDAP or CRLDP authentication profiles attached. Treat these as in-scope assets.
• Correlate BIG-IP performance telemetry (CPU, TMM load, connection rates) with upstream firewall and load balancer logs to identify request sources driving authentication-related CPU spikes.
• Baseline CRL fetch and LDAP bind volumes during normal operations and alert on statistical deviations.

Monitoring Recommendations

• Forward BIG-IP ltm, apm, and system performance logs to a centralized SIEM or data lake for long-term analysis.
• Configure SNMP or iHealth-based alerts on TMM CPU utilization thresholds.
• Monitor authentication profile statistics (tmsh show ltm profile auth) for anomalous request rates against affected virtual servers.

How to Mitigate CVE-2024-23979

Immediate Actions Required

• Identify and patch BIG-IP devices running affected versions, prioritizing internet-facing virtual servers with SSL Client Certificate LDAP or CRLDP authentication profiles.
• Apply rate limiting at upstream network controls to constrain request volume reaching affected virtual servers until patches are deployed.
• Decommission or upgrade BIG-IP instances running software versions that have reached End of Technical Support, as F5 does not evaluate or patch these releases.

Patch Information

F5 has issued fixed software versions and mitigations described in F5 Support Article K000134516. Review the advisory to identify the fixed version corresponding to each deployed BIG-IP module and schedule upgrades accordingly. BIG-IP version 17.1.0 is among the affected releases listed in NVD.

Workarounds

• Remove the SSL Client Certificate LDAP or CRLDP authentication profile from virtual servers where it is not strictly required.
• Restrict client access to virtual servers using these authentication profiles via source IP allowlists enforced on upstream firewalls or BIG-IP packet filters.
• Configure connection and request rate limits on affected virtual servers to reduce the amplification potential of the vulnerable code path.

# Example: list virtual servers and identify auth profiles in use
tmsh list ltm virtual one-line | grep -i auth
tmsh list ltm profile auth

# Example: apply a basic connection rate limit to a virtual server
tmsh modify ltm virtual <vs_name> rate-limit 1000