CVE-2024-23982: F5 BIG-IP PEM DoS Vulnerability

CVE-2024-23982 Overview

CVE-2024-23982 is a denial-of-service vulnerability in F5 BIG-IP Policy Enforcement Manager (PEM). When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. The issue affects classification engines using signature files released between September 8, 2022 and February 16, 2023. F5 maps the weakness to a stack-based buffer overflow [CWE-121] and out-of-bounds write [CWE-787]. Successful exploitation produces traffic interruption on affected devices. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5.

Critical Impact
Remote unauthenticated attackers can crash the Traffic Management Microkernel on BIG-IP devices, disrupting all traffic processed by the appliance.

Affected Products

F5 BIG-IP Policy Enforcement Manager (PEM) with classification profile bound to a UDP virtual server
Classification engines using signature files released between 09-08-2022 and 02-16-2023
BIG-IP versions listed in F5 Security Advisory K000135946 (EoTS versions not evaluated)

Discovery Timeline

2024-02-14 - CVE-2024-23982 published to NVD
2024-12-12 - Last updated in NVD database

Technical Details for CVE-2024-23982

Vulnerability Analysis

The flaw resides in the Traffic Management Microkernel (TMM), the data-plane component that processes all BIG-IP network traffic. When a PEM classification profile is attached to a UDP virtual server, the classification engine inspects incoming UDP datagrams against signature definitions. Specific undisclosed inputs trigger a memory corruption condition that terminates TMM. F5 categorizes the defect as a stack-based buffer overflow with an out-of-bounds write. Because TMM handles every flow on the appliance, its termination interrupts traffic forwarding system-wide until the process restarts.

Root Cause

The root cause is improper bounds handling within the classification engine when parsing UDP request data against signature files released between September 8, 2022 and February 16, 2023. The fixed-size stack buffer is written beyond its boundary, corrupting adjacent memory and crashing the TMM process. F5 has not disclosed the specific signature, field, or packet structure that triggers the condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted UDP traffic to a virtual server that has a PEM classification profile applied. The traffic must reach the classification engine running an affected signature version. No privileged position on the network is required, and exploitation produces availability impact only — confidentiality and integrity are not affected.

No public proof-of-concept exploit is available. Refer to the F5 Security Advisory K000135946 for the complete list of affected signature files and product versions.

Detection Methods for CVE-2024-23982

Indicators of Compromise

Unexpected TMM process restarts logged in /var/log/ltm or /var/log/tmm
Core dump files generated under /var/savecore/ referencing TMM
Brief data-plane outages affecting all virtual servers on the BIG-IP, not only PEM-bound services
Spikes of malformed or unusual UDP traffic directed at virtual servers configured with a PEM classification profile

Detection Strategies

Inventory BIG-IP devices and identify any UDP virtual server with a PEM classification profile attached
Verify the loaded classification signature file version against the affected range (09-08-2022 to 02-16-2023) documented by F5
Correlate TMM termination events with inbound UDP traffic patterns to identify potential exploitation attempts

Monitoring Recommendations

Forward BIG-IP system logs and TMM crash events to a centralized SIEM for alerting on repeated TMM restarts
Monitor availability of UDP-based services fronted by BIG-IP for short outages consistent with TMM cycling
Track signature file versions across the BIG-IP fleet to ensure timely updates after F5 releases corrected signatures

How to Mitigate CVE-2024-23982

Immediate Actions Required

Apply the signature file updates referenced in F5 Security Advisory K000135946
Upgrade BIG-IP to a fixed software version as listed in the F5 advisory if running an affected release
Restrict UDP traffic reaching virtual servers with PEM classification profiles to trusted sources where feasible

Patch Information

F5 has published remediation guidance and updated classification signature files in security advisory K000135946. Customers should consult the advisory for the fixed signature file release and the corresponding BIG-IP software versions. Software branches that have reached End of Technical Support are not evaluated and require an upgrade to a supported release.

Workarounds

Remove the PEM classification profile from UDP virtual servers until updated signatures are deployed
Disable affected classification signatures identified in the F5 advisory table
Apply upstream access control lists to limit which sources can reach UDP virtual servers using PEM classification