CVE-2024-39778: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2024-39778 Overview

CVE-2024-39778 is a denial-of-service vulnerability in F5 BIG-IP systems configured with a stateless virtual server on hardware platforms using a High-Speed Bridge (HSB). Undisclosed requests sent to the affected virtual server can cause the Traffic Management Microkernel (TMM) to terminate, interrupting traffic processing across the device. The flaw affects multiple BIG-IP modules including Local Traffic Manager (LTM), Advanced Firewall Manager (AFM), Access Policy Manager (APM), and others sharing the same TMM data plane. F5 published Security Advisory K05710614 on August 14, 2024, addressing the issue [CWE-702].

Critical Impact
Remote, unauthenticated attackers can trigger TMM termination on affected BIG-IP devices, causing data plane disruption and denial of service to all applications fronted by the appliance.

Affected Products

F5 BIG-IP Local Traffic Manager, Advanced Firewall Manager, and Access Policy Manager (version 17.1.0 and earlier supported releases on HSB hardware)
F5 BIG-IP Advanced Web Application Firewall, Application Security Manager, and SSL Orchestrator
F5 BIG-IP DNS, Global Traffic Manager, Link Controller, Carrier-Grade NAT, Policy Enforcement Manager, DDoS Hybrid Defender, and related modules

Discovery Timeline

2024-08-14 - CVE-2024-39778 published to NVD and F5 advisory K05710614 released
2024-08-19 - Last updated in NVD database

Technical Details for CVE-2024-39778

Vulnerability Analysis

The vulnerability resides in how TMM processes traffic when a stateless virtual server is bound to a BIG-IP platform equipped with a High-Speed Bridge (HSB) ASIC. Stateless virtual servers bypass connection table tracking and forward packets directly through the data plane. When specific undisclosed request patterns reach this configuration, TMM enters an unexpected condition and terminates. Because TMM is the core process responsible for all traffic management, its termination drops every active connection traversing the appliance until the process restarts. The CWE classification of CWE-702 (Exposure of Sensitive Information Due to Incorrect Spec Implementation, here mapped to improper specification handling) reflects a deviation between documented behavior and runtime handling of packets on HSB-equipped hardware.

Root Cause

The root cause is improper handling of certain packet conditions in the TMM-to-HSB processing path when statelessness is enabled. Without connection state, TMM relies on per-packet logic that fails to validate inputs the HSB hardware accepts, leading to an unrecoverable error and process termination. F5 has not disclosed the exact request structure that triggers the condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted traffic to the IP and port of a stateless virtual server hosted on an HSB-enabled BIG-IP appliance. Each successful trigger causes TMM to terminate, producing a service outage for all traffic processed by that TMM instance. The condition can be repeated to sustain a denial-of-service state.

No public proof-of-concept code or exploit is available, and F5 has withheld the specific request format. The vulnerability is therefore described in prose only — see the F5 Security Advisory K05710614 for vendor-supplied technical details.

Detection Methods for CVE-2024-39778

Indicators of Compromise

TMM core dump files appearing in /var/core/ on the BIG-IP device following inbound traffic spikes
/var/log/ltm entries indicating TMM process restarts or signal-terminated workers
Sudden loss of virtual server availability accompanied by failover events on high-availability pairs
Traffic statistics showing abrupt connection drops on virtual servers configured with the stateless type

Detection Strategies

Inventory all virtual servers with the stateless type and correlate against BIG-IP hardware platforms that include HSB (for example, i-Series and select VIPRION blades)
Monitor TMM uptime and restart counts using tmctl -d blade tmm/traffic and SNMP OIDs for process health
Forward BIG-IP ltm, tmm, and audit logs to a centralized SIEM for correlation of crash events with upstream source IPs

Monitoring Recommendations

Enable alerting on repeated TMM segfault or assertion failed messages in BIG-IP system logs
Track packet rates and unusual protocol patterns destined for stateless virtual servers, especially from new or low-reputation sources
Review HA failover frequency, as repeated TMM termination on the active unit will trigger device-group transitions

How to Mitigate CVE-2024-39778

Immediate Actions Required

Identify all BIG-IP devices running supported branches with stateless virtual servers configured on HSB hardware
Apply the engineering hotfix or upgrade to a fixed release as listed in F5 Security Advisory K05710614
If patching is delayed, restrict source networks permitted to reach stateless virtual servers using upstream ACLs or BIG-IP packet filters

Patch Information

F5 provides remediated versions and engineering hotfixes through the F5 Security Advisory K05710614. Software versions that have reached End of Technical Support (EoTS) were not evaluated and should be upgraded to a supported, patched branch. Confirm the fixed release for each affected module before scheduling maintenance.

Workarounds

Convert affected stateless virtual servers to a stateful standard or performance (Layer 4) type where the application design permits
Place an upstream access control list or DDoS mitigation device in front of the BIG-IP to filter untrusted sources from reaching the stateless listener
Disable or remove unused stateless virtual servers to reduce exposed attack surface until patching is complete

bash

# Configuration example: list stateless virtual servers and apply a source address restriction
tmsh list ltm virtual one-line | grep "type stateless"

# Restrict the affected virtual server to trusted source networks
tmsh modify ltm virtual /Common/vs_stateless_example source 10.0.0.0/8
tmsh save sys config