CVE-2024-33608: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2024-33608 Overview

CVE-2024-33608 is a denial-of-service vulnerability affecting F5 BIG-IP products when IPsec is configured on a virtual server. Undisclosed network traffic can cause the Traffic Management Microkernel (TMM) to terminate, disrupting application delivery and traffic processing. The flaw is tracked under [CWE-824: Access of Uninitialized Pointer] and impacts BIG-IP version 17.1.0 across the product family, including LTM, AFM, ASM, APM, and SSL Orchestrator. F5 published the advisory on May 8, 2024, and the entry was last modified in NVD on October 21, 2025. Software versions that reached End of Technical Support (EoTS) were not evaluated.

Critical Impact
A remote, unauthenticated attacker can crash the TMM process, interrupting all traffic handled by the BIG-IP virtual server and causing service outages for protected applications.

Affected Products

F5 BIG-IP Local Traffic Manager (LTM) 17.1.0
F5 BIG-IP Access Policy Manager (APM), Advanced Firewall Manager (AFM), Application Security Manager (ASM) 17.1.0
F5 BIG-IP SSL Orchestrator, Global Traffic Manager (GTM), DNS, Link Controller, and additional modules at version 17.1.0

Discovery Timeline

2024-05-08 - CVE-2024-33608 published to NVD
2024-05-08 - F5 publishes security article K000138728
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2024-33608

Vulnerability Analysis

The Traffic Management Microkernel (TMM) is the core data-plane process in F5 BIG-IP, handling all client and server traffic across virtual servers. When IPsec is configured on a virtual server, specific malformed or unexpected traffic patterns cause TMM to terminate. Because TMM owns connection state and packet forwarding, its termination interrupts all traffic flowing through the device until the process restarts.

The weakness maps to [CWE-824], which describes access of an uninitialized pointer. In practice, this means TMM dereferences memory that was not properly initialized when processing the offending IPsec-related traffic, leading to a fatal fault.

Root Cause

The root cause is improper handling of certain IPsec-associated traffic in the TMM code path. When the affected packet sequence reaches a virtual server with IPsec enabled, TMM accesses an uninitialized pointer and terminates. F5 has not publicly disclosed the specific packet characteristics that trigger the condition.

Attack Vector

Exploitation requires network access to a BIG-IP virtual server with IPsec configured. No authentication, user interaction, or elevated privileges are required. The attacker sends crafted traffic to the listening virtual server, causing TMM to crash. Repeated triggering can result in sustained denial of service. No public proof-of-concept or known in-the-wild exploitation has been reported as of this writing.

No verified exploit code is publicly available for CVE-2024-33608.
Refer to F5 article K000138728 for vendor-supplied technical details.

Detection Methods for CVE-2024-33608

Indicators of Compromise

Unexpected TMM process restarts or core dumps on BIG-IP devices with IPsec-enabled virtual servers
tmm crash entries in /var/log/ltm and corresponding core files under /var/savecore/
High-availability failover events triggered by repeated TMM termination
Sudden loss of connectivity through virtual servers configured with IPsec profiles

Detection Strategies

Monitor BIG-IP system logs (/var/log/ltm, /var/log/messages) for tmm segmentation faults or restart messages
Alert on creation of new core files in /var/savecore/ or /shared/core/
Track failover frequency on HA pairs as a proxy signal for data-plane instability
Correlate inbound traffic spikes on IPsec virtual servers with TMM restart events

Monitoring Recommendations

Forward BIG-IP syslog and SNMP traps to a centralized SIEM or data lake for correlation
Enable iHealth uploads or scheduled qkview generation to capture TMM crash diagnostics
Baseline normal IPsec traffic patterns and alert on anomalies targeting IPsec virtual server VIPs
Review F5 advisory K000138728 for updated detection guidance

How to Mitigate CVE-2024-33608

Immediate Actions Required

Identify BIG-IP devices running version 17.1.0 with IPsec configured on any virtual server
Apply the engineering hotfix or upgrade to a fixed release per F5 article K000138728
Restrict network reachability to IPsec virtual servers using upstream ACLs until patching is complete
Verify HA pair configurations so that a TMM termination on one unit fails over cleanly

Patch Information

F5 has published remediation guidance in security article K000138728. Administrators should consult the advisory for the list of fixed versions and apply the recommended upgrade path for each affected module. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch.

Workarounds

Disable IPsec on virtual servers where it is not required until patches are deployed
Use packet filters or upstream firewalls to limit IPsec traffic sources to known peers
Where feasible, terminate IPsec on a dedicated device rather than the production BIG-IP virtual server
Monitor TMM stability closely and engage F5 Support if repeated terminations occur

bash

# Identify virtual servers with IPsec profiles applied
tmsh list ltm virtual one-line | grep -i ipsec

# Review recent TMM crash entries
grep -i "tmm" /var/log/ltm | grep -iE "restart|exited|core"

# Generate a qkview for F5 Support analysis
qkview -s 0