CVE-2021-22992

What it actually does

This vulnerability is a network-reachable buffer overflow in F5 BIG-IP Advanced WAF / BIG-IP ASM processing when a virtual server has a policy with a configured Login Page. A specially crafted malicious HTTP response processed by the affected policy can corrupt memory, causing a denial of service through process crash or restart. In certain conditions, the memory corruption may be exploitable for remote code execution, which could allow an unauthenticated attacker to execute code on the BIG-IP appliance and potentially gain full control of the device. Affected versions include BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3; end-of-software-development versions were not evaluated and should be treated as higher risk.

Why it matters to the business

Successful exploitation can interrupt traffic handled by BIG-IP virtual servers and may compromise a critical network security appliance that often sits in front of important applications. A denial-of-service outcome can make protected applications unavailable, while remote code execution could allow attackers to alter traffic handling, steal data passing through the device, pivot deeper into the network, or disable security controls. Although it is not listed in CISA KEV and no ransomware use is indicated, the CVSS score is critical and the EPSS probability is high, so exposed vulnerable systems should be prioritized for remediation, especially where Advanced WAF or ASM policies use Login Page functionality.

How an attack unfolds

An attacker identifies an internet-facing or otherwise reachable BIG-IP virtual server protected by Advanced WAF or ASM with a policy that includes Login Page configuration. The attacker then causes the virtual server to process a crafted HTTP response that triggers unsafe memory handling in the affected component. If exploitation only reaches the crash condition, the attacker can repeatedly trigger the flaw to disrupt application availability. If the attacker can shape the response precisely enough for code execution, the overflow may allow execution of attacker-controlled code on the BIG-IP system, creating the possibility of appliance compromise, persistence, traffic interception, configuration tampering, and further internal movement.

How to fix it

Upgrade affected BIG-IP systems to a fixed release: 16.0.1.1 or later for 16.0.x, 15.1.2.1 or later for 15.1.x, 14.1.4 or later for 14.1.x, 13.1.3.6 or later for 13.1.x, 12.1.5.3 or later for 12.1.x, and 11.6.5.3 or later for 11.6.x. Systems on end-of-software-development branches should be migrated to a supported fixed release because they were not evaluated and may remain vulnerable. As temporary risk reduction, review Advanced WAF/ASM policies and disable or remove Login Page configuration where it is not required, restrict exposure of vulnerable virtual servers, limit access to affected applications where possible, and monitor for repeated crashes or abnormal WAF/ASM behavior. Mitigations should not be treated as equivalent to upgrading because the flaw can lead to complete device compromise in some conditions.

How to confirm the fix worked

Confirm the installed BIG-IP version and hotfix level against the fixed versions for each branch. Inventory virtual servers using Advanced WAF or ASM policies and identify policies with Login Page configuration enabled. Verify that all affected appliances have been upgraded or that vulnerable policy functionality has been removed as a temporary control. After remediation, review system and WAF/ASM logs for continued crash events, restart loops, core dumps, or anomalous HTTP response handling. Validate application availability through normal traffic flows and, where change-management allows, perform controlled testing of the affected login workflows to ensure the WAF/ASM policy still operates as intended after the upgrade.

Typical attack path

1. Identify a BIG-IP virtual server reachable over the network.
2. Determine or infer that the virtual server is protected by Advanced WAF or BIG-IP ASM with Login Page functionality enabled.
3. Deliver or induce processing of a malicious HTTP response associated with the protected login workflow.
4. Trigger the buffer overflow in the affected BIG-IP WAF/ASM processing path.
5. Cause a denial of service through crash or restart, or attempt controlled memory corruption for remote code execution.
6. If code execution succeeds, establish control on the BIG-IP appliance and use that access to inspect traffic, modify configuration, deploy persistence, or pivot.

How to detect it

To determine whether exploitation may already have occurred, review BIG-IP system logs, WAF/ASM logs, audit logs, and appliance health monitoring for crashes or restarts around requests to protected login pages. Useful sources include /var/log/ltm, /var/log/asm, /var/log/audit, high-availability failover events, system performance telemetry, and core dump directories. Look for repeated TMM or ASM-related crashes, segmentation faults, watchdog restarts, unexplained failovers, and spikes in HTTP traffic involving login workflows immediately before service disruption. For possible remote code execution, investigate unexpected child processes, shell execution, new or modified files in writable directories, unauthorized configuration changes, unusual outbound connections from the BIG-IP management or self IPs, new administrative accounts, altered iRules, modified WAF/ASM policies, and suspicious entries in audit logs. Because there are no universal exploit strings for this issue, detection should combine version exposure, policy configuration, crash artifacts, abnormal process activity, and network telemetry rather than relying only on static signatures.

• /var/log/ltm
• /var/log/asm
• /var/log/audit
• /var/core
• /shared/core
• segmentation fault
• core dumped
• tmm crash
• tmm restarted
• asm crash
• ASM restarted
• watchdog
• sod
• failover
• Login Page
• Advanced WAF
• ASM policy
• /bin/sh
• /bin/bash
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory BIG-IP deployments and identify systems running affected versions with Advanced WAF or ASM enabled.
• Prioritize internet-facing virtual servers and any policy using Login Page functionality for upgrade to the fixed versions.
• Upgrade or migrate end-of-software-development BIG-IP branches to supported fixed releases rather than relying on unsupported software.
• Until patching is complete, reduce exposure of vulnerable virtual servers and remove unnecessary Login Page configuration from WAF/ASM policies.
• Review BIG-IP logs, core dump locations, and monitoring alerts for historical crashes or abnormal WAF/ASM behavior that may indicate attempted exploitation.
• Treat any confirmed remote code execution indicators on a BIG-IP appliance as a high-severity network appliance compromise requiring full incident response, credential rotation, configuration review, and traffic inspection.
• Increase monitoring for anomalous outbound connections, unexpected shell execution, configuration changes, and unauthorized administrative access on BIG-IP systems.