CVE-2024-28889: F5 BIG-IP Access Policy Manager DoS Vulnerability

CVE-2024-28889 Overview

CVE-2024-28889 is a denial-of-service vulnerability affecting F5 BIG-IP products when an SSL profile with a non-default alert timeout value is configured on a virtual server. Under specific conditions outside the attacker's direct control, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. The issue is tracked under [CWE-825: Expired Pointer Dereference] and impacts availability of traffic processing on affected appliances. F5 published guidance in Technical Article K000138912.

Critical Impact
Termination of the TMM process disrupts all traffic flowing through the affected BIG-IP virtual server, causing an outage of load-balancing, SSL/TLS termination, and security services until the process recovers.

Affected Products

F5 BIG-IP Local Traffic Manager, Access Policy Manager, and Advanced Web Application Firewall
F5 BIG-IP Advanced Firewall Manager, Application Security Manager, and DDoS Hybrid Defender
F5 BIG-IP SSL Orchestrator, Global Traffic Manager, Link Controller, and additional BIG-IP modules listed in K000138912

Discovery Timeline

2024-05-08 - CVE-2024-28889 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28889

Vulnerability Analysis

The defect exists in the Traffic Management Microkernel (TMM), the core packet-processing daemon on BIG-IP. When an SSL profile is applied to a virtual server with an alert timeout set to a value other than the default, TMM can dereference a resource whose lifetime has already expired while handling specific TLS traffic patterns. The result is process termination and a temporary loss of data plane functionality. Because triggering conditions depend on factors beyond the attacker's control, exploitation is not deterministic, which is reflected in the high attack complexity of the CVSS vector. Only configurations using non-default alert timeout values are exposed; default-configured SSL profiles are not affected.

Root Cause

The root cause maps to CWE-825 (Expired Pointer Dereference). TMM retains a reference to an SSL session or timer object that has already been released or invalidated by the alert-timeout logic. When subsequent traffic causes that stale reference to be used, TMM aborts to preserve integrity, taking the data plane down with it.

Attack Vector

The vulnerability is network-reachable and requires no authentication or user interaction. An unauthenticated remote attacker sending traffic to a vulnerable virtual server can, under the right timing and connection-state conditions, trigger TMM termination. No confidentiality or integrity impact is present; the impact is limited to availability. No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the F5 advisory K000138912 for the vulnerable version matrices and fixed builds.

Detection Methods for CVE-2024-28889

Indicators of Compromise

Unexpected TMM restarts recorded in /var/log/ltm or entries such as Traffic Management Microkernel terminated in the BIG-IP system logs.
Core dump files generated under /var/core/ referencing the tmm binary shortly after SSL/TLS traffic bursts.
Brief but repeated data plane outages coinciding with TLS handshakes to virtual servers using SSL profiles with non-default alert timeout values.

Detection Strategies

Audit all SSL client and server profiles for alert timeout values that differ from the default and correlate them with virtual server assignments.
Monitor BIG-IP high-availability failover events, since TMM crashes can trigger unplanned failovers between active and standby units.
Ingest BIG-IP syslog and iHealth qkview data into a centralized analytics platform to flag recurring TMM termination signatures.

Monitoring Recommendations

Forward ltm, daemon, and kernel logs from BIG-IP devices to a SIEM and alert on TMM restart or core dump events.
Track SNMP counters for virtual server connection resets and sudden drops in active connections that align with TMM restarts.
Baseline TLS handshake failure rates per virtual server so anomalous spikes tied to alert timeout behavior become visible.

How to Mitigate CVE-2024-28889

Immediate Actions Required

Inventory every BIG-IP virtual server with an SSL profile and identify profiles configured with a non-default alert timeout.
Apply the fixed BIG-IP software versions listed by F5 in K000138912 during the next available maintenance window.
Retire or upgrade BIG-IP versions that have reached End of Technical Support, since F5 does not evaluate them for this CVE.

Patch Information

F5 has published fixed versions in the security advisory K000138912. Administrators should consult the article for the specific fixed builds that correspond to their installed BIG-IP branch and module set, then follow F5's standard software installation procedure.

Workarounds

Revert affected SSL client and server profiles to the default alert timeout value until patched builds are deployed.
Restrict network exposure of vulnerable virtual servers to trusted sources using upstream firewalls or BIG-IP AFM policies.
Ensure BIG-IP high-availability pairs are healthy so that a TMM termination on one unit fails traffic over cleanly to the peer.

bash

# Configuration example: reset SSL profile alert timeout to default via tmsh
tmsh modify ltm profile client-ssl <profile_name> alert-timeout indefinite
tmsh modify ltm profile server-ssl <profile_name> alert-timeout indefinite
tmsh save sys config