F5 BIG-IP PEM up to 15.1.10/16.1.4/17.1.1 Traffic Management Microkernel stack-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in F5 BIG-IP PEM up to 15.1.10/16.1.4/17.1.1. Affected is an unknown function of the component Traffic Management Microkernel. Performing a manipulation results in stack-based overflow. This vulnerability is reported as CVE-2024-23982. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in F5 BIG-IP PEM up to 15.1.10/16.1.4/17.1.1 (Firewall Software). This affects some unknown functionality of the component Traffic Management Microkernel. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue affects classification engines using signatures released between 09-08-2022 and 02-16-2023. See the table in the F5 Security Advisory for a complete list of affected classification signature files.  NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated

The weakness was disclosed 02/14/2024 as K000135946. The advisory is shared at my.f5.com. This vulnerability is uniquely identified as CVE-2024-23982 since 02/01/2024. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/13/2024).

Applying a patch is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP PEM

Version

• 15.1.0
• 15.1.1
• 15.1.2
• 15.1.3
• 15.1.4
• 15.1.5
• 15.1.6
• 15.1.7
• 15.1.8
• 15.1.9
• 15.1.10
• 16.1.0
• 16.1.1
• 16.1.2
• 16.1.3
• 16.1.4
• 17.1.0
• 17.1.1

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion