CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow

Vulnerability summary

CVE-2021-22991 is a critical (CVSS 9.8) vulnerability in F5 BIG-IP Traffic Management Microkernel. It is known to be exploited: CISA lists it, first on 18-01-2022. EPSS estimates a 61.06% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities.

Timeline

1. 31-03-2021
   PublishedVulnerability first disclosed.
2. 18-01-2022
   Added to CISA KEVF5 BIG-IP Traffic Management Microkernel Buffer Overflow
3. 01-02-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.