CVE-2021-22991:Buffer overflow vulnerability in F5 BIG-IP Traffic Management Microkernel (TMM) URI normalization that could lead to DoS, access control bypass, or remote code execution.

splash
Back

Description Preview

A critical vulnerability exists in F5 BIG-IP systems where undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization. This can trigger a buffer overflow, resulting in a denial of service (DoS) attack. In certain situations, this vulnerability may theoretically allow bypass of URL-based access control or even remote code execution (RCE). The vulnerability affects multiple versions of BIG-IP, including 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3.

Overview

CVE-2021-22991 is a buffer overflow vulnerability (CWE-119) in F5 BIG-IP's Traffic Management Microkernel (TMM) URI normalization component. When a virtual server receives certain undisclosed requests, the TMM may incorrectly handle URI normalization, leading to a buffer overflow condition. The primary impact is denial of service, but under specific circumstances, it could potentially allow attackers to bypass URL-based access controls or execute arbitrary code remotely. This vulnerability affects multiple versions of F5 BIG-IP systems and is considered critical due to its potential impact on system availability and security.

Remediation

Organizations should upgrade their F5 BIG-IP systems to the following patched versions or later:

  • Version 16.0.x: Upgrade to 16.0.1.1 or later
  • Version 15.1.x: Upgrade to 15.1.2.1 or later
  • Version 14.1.x: Upgrade to 14.1.4 or later
  • Version 13.1.x: Upgrade to 13.1.3.6 or later
  • Version 12.1.x: Upgrade to 12.1.5.3 or later

If immediate patching is not possible, consult the F5 support article K56715231 for potential mitigations or workarounds. It's important to note that software versions that have reached End of Software Development (EoSD) are not evaluated for this vulnerability and should be upgraded to supported versions as soon as possible.

References

  • F5 Support Knowledge Base Article: https://support.f5.com/csp/article/K56715231
  • Common Weakness Enumeration (CWE-119): Buffer Overflow
  • CVSS Score: Not provided in the original data
  • CVE ID: CVE-2021-22991

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Finance and Insurance
    Finance and Insurance
  3. Management of Companies & Enterprises
    Management of Companies & Enterprises
  4. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  5. Transportation & Warehousing
    Transportation & Warehousing
  6. Accommodation & Food Services
    Accommodation & Food Services
  7. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  8. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  9. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  10. Construction
    Construction
  11. Educational Services
    Educational Services
  12. Health Care & Social Assistance
    Health Care & Social Assistance
  13. Information
    Information
  14. Mining
    Mining
  15. Other Services (except Public Administration)
    Other Services (except Public Administration)
  16. Public Administration
    Public Administration
  17. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  18. Retail Trade
    Retail Trade
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database