CVE-2024-41727: F5 BIG-IP Access Policy Manager DOS Flaw

CVE-2024-41727 Overview

CVE-2024-41727 is a resource exhaustion vulnerability affecting F5 BIG-IP tenants running on r2000 and r4000 series hardware, as well as BIG-IP Virtual Edition (VE) deployments using the Intel E810 SR-IOV network interface card. Undisclosed network traffic can trigger an increase in memory resource utilization on affected systems, leading to a denial of service condition. The flaw is tracked under [CWE-400] (Uncontrolled Resource Consumption) and [CWE-770] (Allocation of Resources Without Limits or Throttling). F5 has published an advisory describing the impact, and software versions that have reached End of Technical Support (EoTS) are not evaluated for this issue.

Critical Impact

A remote, unauthenticated attacker can exhaust memory on affected BIG-IP tenants by sending undisclosed traffic patterns, degrading or disrupting availability of load balancing, firewall, and application delivery services.

Affected Products

• F5 BIG-IP tenants on r2000 series hardware
• F5 BIG-IP tenants on r4000 series hardware
• F5 BIG-IP Virtual Edition (VE) deployments using Intel E810 SR-IOV NIC, including modules such as Access Policy Manager, Advanced Firewall Manager, Advanced WAF, Local Traffic Manager, Global Traffic Manager, SSL Orchestrator, and Policy Enforcement Manager

Discovery Timeline

• 2024-08-14 - CVE-2024-41727 published to NVD
• 2024-08-20 - Last updated in NVD database

Technical Details for CVE-2024-41727

Vulnerability Analysis

The vulnerability resides in how BIG-IP tenants handle traffic on specific hardware and virtual NIC configurations. On r2000 and r4000 series chassis, and on Virtual Edition instances bound to Intel E810 SR-IOV interfaces, certain undisclosed traffic patterns trigger allocation of memory that is not properly bounded or released. As traffic continues, memory utilization grows until the tenant approaches or reaches resource limits.

Memory pressure on a BIG-IP appliance directly impacts the Traffic Management Microkernel (TMM) and associated control plane processes. When memory is exhausted, the tenant can degrade traffic processing performance, drop connections, or fail health checks managed by the host blade.

F5's advisory categorizes the issue as an availability impact only — confidentiality and integrity are not affected. The attack vector is network-based, requires no authentication, and requires no user interaction.

Root Cause

The root cause is uncontrolled resource consumption tied to traffic handling paths specific to r2000/r4000 hardware tenants and the Intel E810 SR-IOV driver path used by certain BIG-IP VE deployments. F5 has not disclosed the exact traffic characteristics that trigger the allocation, consistent with [CWE-770] where allocations occur without sufficient throttling.

Attack Vector

An attacker reaches the affected tenant over the network and sends traffic crafted to exercise the vulnerable code path. Because the trigger is undisclosed and does not require authentication, any network-reachable BIG-IP data plane on a vulnerable platform is exposed. Repeated traffic causes progressive memory growth until the tenant is exhausted.

No public proof-of-concept code, exploit module, or active exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are limited; refer to the F5 Security Article K000138833 for vendor-provided details.

Detection Methods for CVE-2024-41727

Indicators of Compromise

• Sustained or unexplained growth in TMM and system memory utilization on BIG-IP tenants running on r2000/r4000 chassis or VE instances bound to Intel E810 SR-IOV NICs.
• Tenant restarts, failover events, or tmm core processes consuming abnormal amounts of memory without a corresponding increase in legitimate traffic volume.
• SNMP or telemetry alerts firing on memory thresholds such as sysGlobalHostInfoStat.memoryUsed and per-tenant memory counters.

Detection Strategies

• Monitor tmsh show sys memory and tmsh show sys tmm-info output over time to baseline normal memory utilization and detect anomalous growth patterns.
• Correlate memory increases with traffic flow records to identify whether specific source IPs, protocols, or packet patterns precede the resource spike.
• Forward BIG-IP syslog, SNMP traps, and iHealth diagnostics to a centralized log platform for longitudinal analysis and alerting on availability degradation.

Monitoring Recommendations

• Enable threshold-based alerting on per-tenant memory utilization with conservative warning levels (for example, 70% warning, 85% critical) on r2000, r4000, and E810-equipped VE deployments.
• Track interface and driver-level counters on Intel E810 SR-IOV virtual functions for drops, restarts, or queue stalls that correlate with memory pressure.
• Review F5 iHealth uploads regularly to surface vendor-detected indicators tied to K000138833.

How to Mitigate CVE-2024-41727

Immediate Actions Required

• Identify all BIG-IP tenants running on r2000 and r4000 chassis, and any BIG-IP VE instances using Intel E810 SR-IOV NICs, and confirm software versions are within F5's supported (non-EoTS) range.
• Apply the fixed software versions listed in F5 Security Article K000138833 as soon as maintenance windows permit.
• Restrict network exposure of management and data plane interfaces to trusted segments while patching is scheduled.

Patch Information

F5 has documented fixed releases and remediation guidance in F5 Security Article K000138833. Customers running End of Technical Support versions must upgrade to a supported branch, as EoTS versions are not evaluated for this CVE. Validate that both the BIG-IP software version and the relevant hardware or NIC driver components meet the fixed-version criteria.

Workarounds

• Apply traffic rate limiting and connection limits on virtual servers exposed to untrusted networks to slow the rate at which memory can be exhausted.
• Use upstream firewall or access control lists to restrict data plane access to known client ranges where business requirements allow.
• Configure tenant memory and resource provisioning headroom on r2000/r4000 chassis so that a single tenant cannot impact peer tenants during resource pressure.

# Configuration example - set connection and rate limits on a virtual server
tmsh modify ltm virtual <virtual_server_name> \
    rate-limit 1000 \
    connection-limit 10000

# Apply a rate-limiting policy to throttle aggressive sources
tmsh create security dos profile dos_mitigate_41727 \
    application add { default { rate-limit 5000 } }

tmsh modify ltm virtual <virtual_server_name> \
    profiles add { dos_mitigate_41727 }