CVE-2025-41431: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2025-41431 Overview

CVE-2025-41431 is a denial of service vulnerability affecting F5 BIG-IP systems configured with connection mirroring on virtual servers. When exploited, specially crafted undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate on standby BIG-IP systems within a traffic group. This vulnerability poses a significant risk to high availability configurations, as it specifically targets standby devices that are critical for failover scenarios.

The TMM is a core component of F5 BIG-IP that handles all load-balanced traffic processing. A crash in this microkernel results in service disruption and potentially compromises the redundancy that organizations rely upon for business continuity.

Critical Impact

Unauthenticated remote attackers can cause TMM termination on standby BIG-IP systems, potentially disrupting high availability configurations and failover capabilities across multiple F5 BIG-IP product lines.

Affected Products

• F5 BIG-IP Access Policy Manager version 17.1.2
• F5 BIG-IP Advanced Firewall Manager version 17.1.2
• F5 BIG-IP Analytics version 17.1.2
• F5 BIG-IP Application Acceleration Manager version 17.1.2
• F5 BIG-IP Application Security Manager version 17.1.2
• F5 BIG-IP Domain Name System version 17.1.2
• F5 BIG-IP Fraud Protection Service version 17.1.2
• F5 BIG-IP Global Traffic Manager version 17.1.2
• F5 BIG-IP Link Controller version 17.1.2
• F5 BIG-IP Local Traffic Manager version 17.1.2
• F5 BIG-IP Policy Enforcement Manager version 17.1.2

Discovery Timeline

• 2025-05-07 - CVE-2025-41431 published to NVD
• 2025-08-06 - Last updated in NVD database

Technical Details for CVE-2025-41431

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write), indicating that the TMM process improperly handles certain network requests when connection mirroring is enabled. The out-of-bounds write condition can corrupt memory structures within the TMM, leading to process termination.

Connection mirroring is a feature used in BIG-IP high availability configurations to synchronize connection state information between active and standby devices. When enabled, the standby device maintains connection tables that mirror the active device, allowing for seamless failover without disrupting existing client sessions. The vulnerability specifically manifests when the standby system processes mirrored connection data containing malformed or unexpected request structures.

The attack can be executed remotely over the network without requiring authentication or user interaction. The impact is primarily against system availability, with no direct confidentiality or integrity compromise on the primary target. However, the ability to crash standby systems could be leveraged as part of a larger attack strategy to eliminate failover protection before targeting the active device.

Root Cause

The root cause is an out-of-bounds write vulnerability (CWE-787) in the TMM component. When processing certain undisclosed request types during connection mirroring operations, the TMM fails to properly validate memory boundaries before writing data. This memory safety issue allows specially crafted network traffic to trigger a write operation beyond allocated buffer boundaries, corrupting adjacent memory and causing the TMM process to crash.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can send specially crafted requests to a BIG-IP virtual server configured with connection mirroring. The malicious requests are processed and mirrored to standby systems in the traffic group, where the out-of-bounds write condition is triggered in the TMM process.

The attack specifically targets the high availability infrastructure rather than the active processing node, making it particularly insidious as it silently degrades redundancy capabilities. Organizations may not immediately notice that their failover systems have been compromised until an actual failover event is required.

Detection Methods for CVE-2025-41431

Indicators of Compromise

• Unexpected TMM process restarts or crashes on standby BIG-IP systems within traffic groups
• Core dump files generated by TMM crashes in /var/core/ directory
• Log entries in /var/log/ltm indicating TMM termination events
• High availability alerts showing standby device status changes

Detection Strategies

• Monitor BIG-IP system logs for TMM crash events, particularly on standby devices in traffic groups
• Implement alerting for unexpected TMM restarts using SNMP traps or syslog forwarding
• Track high availability status changes across traffic groups for anomalous patterns
• Review network traffic to virtual servers with connection mirroring for suspicious request patterns

Monitoring Recommendations

• Enable detailed logging for TMM events and forward to centralized SIEM systems
• Configure health monitoring for all devices in BIG-IP traffic groups to detect availability degradation
• Establish baseline TMM restart frequency and alert on deviations from normal patterns
• Monitor device sync status between active and standby pairs for unexpected changes

How to Mitigate CVE-2025-41431

Immediate Actions Required

• Review F5 security advisory K000150668 for vendor-specific guidance and patch availability
• Inventory all BIG-IP devices running version 17.1.2 with connection mirroring enabled
• Assess the criticality of connection mirroring for each virtual server configuration
• Prioritize patching for internet-facing BIG-IP deployments with connection mirroring enabled

Patch Information

F5 has published security advisory K000150668 addressing this vulnerability. Organizations should consult this advisory for specific patch versions and upgrade guidance. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Contact F5 support or refer to the vendor advisory for information on obtaining and applying the appropriate security patches for your BIG-IP deployment.

Workarounds

• Consider temporarily disabling connection mirroring on non-critical virtual servers until patches can be applied
• Implement network-level access controls to restrict traffic sources to virtual servers with connection mirroring
• Deploy additional monitoring for standby device health to quickly detect and respond to TMM crashes
• Ensure backup and recovery procedures are tested for rapid restoration of standby devices

# Check connection mirroring status on virtual servers
tmsh list ltm virtual all | grep -A5 "mirror"

# Review TMM crash logs
cat /var/log/ltm | grep -i "tmm\|crash\|core"

# Monitor high availability status
tmsh show cm traffic-group all