CVE-2025-23412: F5 BIG-IP APM DoS Vulnerability

CVE-2025-23412 Overview

CVE-2025-23412 is a high-severity denial of service vulnerability affecting F5 BIG-IP Access Policy Manager (APM). When a BIG-IP APM Access Profile is configured on a virtual server, specially crafted undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly. This vulnerability allows remote attackers to disrupt critical network services without authentication, potentially causing significant operational impact to organizations relying on BIG-IP for access management and application delivery.

Critical Impact

Remote unauthenticated attackers can crash the TMM process, causing denial of service for all traffic handled by the affected BIG-IP virtual server with APM Access Profile enabled.

Affected Products

• F5 BIG-IP Access Policy Manager (APM)
• BIG-IP virtual servers with APM Access Profile configured
• Systems not at End of Technical Support (EoTS) status

Discovery Timeline

• 2025-02-05 - CVE-2025-23412 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-23412

Vulnerability Analysis

This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The flaw exists in the Traffic Management Microkernel (TMM), which is the core data plane component responsible for processing all traffic through the BIG-IP system.

When an APM Access Profile is attached to a virtual server, the TMM processes authentication and authorization requests. The vulnerability arises from improper bounds checking when handling specific request types, allowing attackers to trigger memory corruption that results in TMM process termination.

The attack can be executed remotely over the network without requiring any authentication or user interaction. While the vulnerability does not directly compromise confidentiality or integrity, the availability impact is significant. Additionally, there is a limited downstream impact on availability for connected systems that depend on the BIG-IP for access management services.

Root Cause

The root cause is a buffer overflow condition (CWE-120) in the TMM component when processing requests through an APM Access Profile. The vulnerability occurs because input data is copied to a buffer without proper validation of the input size, leading to memory corruption when malformed requests are received. This results in the TMM process crashing, which disrupts all traffic processing on the affected virtual server.

Attack Vector

The attack vector is network-based, requiring no authentication, no user interaction, and presenting low attack complexity. An attacker can send specially crafted requests to a BIG-IP virtual server configured with an APM Access Profile to trigger the buffer overflow condition.

The exploitation flow involves:

1. Identifying a target BIG-IP system with APM Access Profile enabled on a virtual server
2. Crafting malicious requests designed to trigger the buffer overflow in TMM
3. Sending the requests to the target virtual server
4. TMM crashes, causing denial of service for legitimate users

For technical details on the specific request format, refer to the F5 Security Advisory K000141003.

Detection Methods for CVE-2025-23412

Indicators of Compromise

• Unexpected TMM process restarts or crashes in /var/log/ltm
• High availability (HA) failover events without apparent cause
• Connection drops and timeouts for users accessing APM-protected resources
• Core dump files in /var/core/ related to TMM processes

Detection Strategies

• Monitor TMM process stability and restart frequency using SNMP traps or syslog alerts
• Implement network intrusion detection rules to identify anomalous traffic patterns targeting APM virtual servers
• Review BIG-IP system logs for TMM termination events with tmctl or through the BIG-IP GUI
• Deploy behavioral analysis to detect unusual request patterns to APM-enabled virtual servers

Monitoring Recommendations

• Enable detailed logging for APM Access Profiles to capture request characteristics
• Configure alerts for TMM process restarts in your SIEM or monitoring platform
• Monitor BIG-IP high availability status for unexpected failover events
• Track connection statistics for sudden drops in active sessions

How to Mitigate CVE-2025-23412

Immediate Actions Required

• Apply the security patch provided by F5 as documented in the security advisory
• Review all virtual servers to identify those with APM Access Profile configurations
• Consider implementing network-level access controls to limit exposure of APM-enabled virtual servers
• Enable monitoring for TMM process stability to detect exploitation attempts

Patch Information

F5 has released security updates to address CVE-2025-23412. Administrators should consult the F5 Security Advisory K000141003 for specific version information and patch downloads. Organizations should prioritize patching based on the criticality of their BIG-IP APM deployments and exposure to untrusted networks.

Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Implement network segmentation to restrict access to APM-enabled virtual servers from untrusted networks
• Use iRules or AFM (Advanced Firewall Manager) to filter potentially malicious traffic before it reaches the APM module
• If APM is not required for specific virtual servers, consider temporarily removing the Access Profile until patching is complete
• Deploy a web application firewall (WAF) in front of BIG-IP to provide additional request filtering

# Example: Check for APM Access Profiles on virtual servers
tmsh list ltm virtual | grep -A 5 "access-profile"

# Example: Monitor TMM process status
tmctl -c tmm/health

# Example: Review TMM logs for crash events
grep -i "tmm" /var/log/ltm | grep -i "exit\|terminate\|restart"