CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow, actively exploited

Description

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

F5 Big-ip Access Policy Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Advanced Firewall Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Advanced Web Application Firewall≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Analytics≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Application Acceleration Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Application Security Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Ddos Hybrid Defender≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Domain Name System≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Fraud Protection Service≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Global Traffic Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Link Controller≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Local Traffic Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 Big-ip Policy Enforcement Manager≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

F5 SSL Orchestrator≥ 12.1.0 < 12.1.5.3 · ≥ 13.1.0 < 13.1.3.6 · ≥ 14.1.0 < 14.1.4 · ≥ 15.1.0 < 15.1.2.1

Remediation

Fixed in

F5 Big-ip Access Policy Manager≥ 12.1.5.3

F5 Big-ip Advanced Firewall Manager≥ 12.1.5.3

F5 Big-ip Advanced Web Application Firewall≥ 12.1.5.3

F5 Big-ip Analytics≥ 12.1.5.3

F5 Big-ip Application Acceleration Manager≥ 12.1.5.3

F5 Big-ip Application Security Manager≥ 12.1.5.3

F5 Big-ip Ddos Hybrid Defender≥ 12.1.5.3

F5 Big-ip Domain Name System≥ 12.1.5.3

F5 Big-ip Fraud Protection Service≥ 12.1.5.3

F5 Big-ip Global Traffic Manager≥ 12.1.5.3

Patch & vendor advisories

https://support.f5.com/csp/article/K56715231

References

https://support.f5.com/csp/article/K56715231Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22991US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-22991 being actively exploited?

Yes. CVE-2021-22991 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 18 Jan 2022.

How severe is CVE-2021-22991?

CVE-2021-22991 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 61.1% probability of exploitation.

Which products are affected by CVE-2021-22991?

Affected products include F5 Big-ip Access Policy Manager, F5 Big-ip Advanced Firewall Manager, F5 Big-ip Advanced Web Application Firewall, F5 Big-ip Analytics, F5 Big-ip Application Acceleration Manager, and 9 more.

How do I fix CVE-2021-22991?

Upgrade affected software to a fixed version, for example F5 Big-ip Access Policy Manager 12.1.5.3, F5 Big-ip Advanced Firewall Manager 12.1.5.3, F5 Big-ip Advanced Web Application Firewall 12.1.5.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-22991 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo