CVE-2024-24775: F5 BIG-IP APM DOS Vulnerability

CVE-2024-24775 Overview

CVE-2024-24775 affects F5 BIG-IP products when a virtual server is enabled with a VLAN group and a Secure Network Address Translation (SNAT) listener is configured. Undisclosed network traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a denial of service condition. The vulnerability is rooted in a NULL pointer dereference [CWE-476] within the TMM data plane. F5 has not evaluated software versions that have reached End of Technical Support (EoTS).

Critical Impact
Remote, unauthenticated attackers can crash the TMM process, disrupting traffic processing across affected BIG-IP modules and causing service outages.

Affected Products

F5 BIG-IP Local Traffic Manager, Access Policy Manager, and Advanced Firewall Manager (including 17.1.0)
F5 BIG-IP Application Security Manager, Analytics, Application Acceleration Manager, and Policy Enforcement Manager
F5 BIG-IP Domain Name System, Global Traffic Manager, Link Controller, Fraud Protection Service, and BIG-IQ Centralized Management

Discovery Timeline

2024-02-14 - CVE-2024-24775 published to the National Vulnerability Database (NVD)
2025-01-23 - Last updated in NVD database

Technical Details for CVE-2024-24775

Vulnerability Analysis

The vulnerability resides in the Traffic Management Microkernel (TMM), the core data plane process responsible for handling all client and server traffic on F5 BIG-IP appliances. When a virtual server is bound to a VLAN group and a SNAT listener is configured on the same interface, a specific traffic pattern triggers a NULL pointer dereference inside TMM. The dereference terminates TMM, after which the system attempts to restart the process, causing a transient or sustained outage depending on attacker persistence.

Because TMM processes every packet traversing the appliance, its termination breaks load balancing, firewalling, and application delivery functions simultaneously. F5 classifies this as a control-plane availability issue with no impact on confidentiality or integrity.

Root Cause

The root cause is a NULL pointer dereference [CWE-476] in the traffic handling logic that processes packets matching a VLAN-group-enabled virtual server combined with a configured SNAT listener. A code path fails to validate a pointer before dereferencing it, leading to a segmentation fault when the specific undisclosed traffic pattern is processed.

Attack Vector

An unauthenticated remote attacker sends crafted network traffic to an affected BIG-IP virtual server. The attack requires no privileges and no user interaction. Exploitation requires that the target virtual server be configured with both a VLAN group and a SNAT listener, which is a common deployment pattern in enterprise traffic management environments.

F5 has not publicly disclosed the exact packet structure required to trigger the crash. The vulnerability affects the data plane directly, so any network position with reachability to the listener is sufficient.

Detection Methods for CVE-2024-24775

Indicators of Compromise

Unexpected TMM process restarts logged in /var/log/ltm containing entries such as tmm exited with status or core dump references.
Generation of TMM core files under /var/savecore or /shared/core following inbound traffic spikes.
Brief connectivity outages for virtual servers configured with VLAN groups and SNAT listeners.

Detection Strategies

Audit BIG-IP configurations to enumerate virtual servers that combine VLAN groups with SNAT listeners, isolating the exposed surface.
Correlate TMM crash events with inbound traffic flows from external sources using high-availability and syslog telemetry.
Forward BIG-IP logs to a centralized SIEM and alert on repeated TMM restart events within short time windows.

Monitoring Recommendations

Enable SNMP and iHealth monitoring for TMM process state and core dump generation.
Alert on the appearance of new files in BIG-IP core dump directories.
Track packet drop counters and virtual server availability metrics for sudden anomalies indicating data plane termination.

How to Mitigate CVE-2024-24775

Immediate Actions Required

Upgrade affected BIG-IP and BIG-IQ instances to a fixed version as listed in the F5 Knowledge Article K000137333.
Identify all virtual servers configured with both VLAN groups and SNAT listeners and prioritize them for remediation.
Restrict network reachability to affected virtual servers using upstream ACLs while patching is scheduled.

Patch Information

F5 has published remediation guidance and fixed software versions in F5 Knowledge Article K000137333. Software releases that have reached End of Technical Support are not evaluated and should be upgraded to a supported, fixed branch. Apply patches following F5's recommended maintenance procedures for high-availability pairs to avoid traffic disruption during the upgrade.

Workarounds

Where operationally feasible, reconfigure the affected virtual server to use individual VLANs instead of a VLAN group until patching is complete.
Remove or relocate the SNAT listener configuration if the virtual server function does not strictly require it.
Apply ingress filtering at upstream firewalls to limit exposure of the affected listener to trusted sources only.

bash

# Configuration example: enumerate virtual servers using VLAN groups and SNAT
# Run from BIG-IP TMOS shell (tmsh) to identify exposure
tmsh list net vlan-group
tmsh list ltm virtual one-line | grep -E "vlans-enabled|source-address-translation"
tmsh list ltm snat