F5 BIG-IP up to 14.1.5.2/15.1.8.0/16.1.3.2 Traffic Management Microkernel stack-based overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in F5 BIG-IP up to 14.1.5.2/15.1.8.0/16.1.3.2. This affects an unknown part of the component Traffic Management Microkernel. Performing a manipulation results in stack-based overflow. This vulnerability is cataloged as CVE-2023-22842. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in F5 BIG-IP up to 14.1.5.2/15.1.8.0/16.1.3.2 (Firewall Software). This affects an unknown functionality of the component Traffic Management Microkernel. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The weakness was shared 02/01/2023 as K08182564. The advisory is shared at my.f5.com. This vulnerability is uniquely identified as CVE-2023-22842 since 01/13/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/01/2023).

Upgrading to version 14.1.5.3, 15.1.8.1 or 16.1.3.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 14.1.5.0
• 14.1.5.1
• 14.1.5.2
• 15.1.0
• 15.1.1
• 15.1.2
• 15.1.3
• 15.1.4
• 15.1.5
• 15.1.6
• 15.1.7
• 15.1.8.0
• 16.1.3.0
• 16.1.3.1
• 16.1.3.2

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion