CVE-2021-22991criticalunder attackCWE-119

CVE-2021-22991: critical vulnerability in BIG-IP

Published · Updated

Follow this CVE+ Monitor BIG-IP+ Monitor BIG-IP Traffic Management Microkernel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 62%
from disclosure to weapon
Published on NVDMar 31
CISA KEV+293d
Action required by CISAfederal deadline: 2022-02-01

Apply updates per vendor instructions.

In short

A flaw in how F5 BIG-IP processes certain web requests can cause the system to crash or potentially allow an attacker to run malicious code. This happens because the system doesn't properly check the size of data it processes when handling web addresses.

Technical detail

CVE-2021-22991 is a buffer overflow vulnerability in the Traffic Management Microkernel (TMM) URI normalization component affecting multiple BIG-IP versions. The vulnerability is triggered by specially crafted requests to a virtual server that bypass proper bounds checking, leading to denial of service, potential URL-based access control bypass, or remote code execution depending on exploitation context and system configuration.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · BIG-IP