CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Description
CVE-2021-22991 is a critical-severity buffer overflow vulnerability in the F5 BIG-IP Traffic Management Microkernel (TMM) that can result in denial of service, URL-based access control bypass, or potentially remote code execution. The vulnerability is triggered by undisclosed requests to a virtual server where URI normalization in the TMM mishandles input, causing a buffer overflow. Affected versions include BIG-IP 16.0.x, 15.1.x, 14.1.x, 13.1.x, and 12.1.x across numerous BIG-IP product modules. CISA has added CVE-2021-22991 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 73.10% (98.77th percentile), this F5 BIG-IP vulnerability poses a significant exploitation risk to organizations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip advanced firewall manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip advanced web application firewall | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip analytics | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip application acceleration manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip application security manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip ddos hybrid defender | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip domain name system | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip fraud protection service | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip global traffic manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip link controller | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip local traffic manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip policy enforcement manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | ssl orchestrator | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.f5.com/csp/article/K56715231(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22991(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer occurs when software performs operations on a memory buffer but can read from or write to a memory location outside the intended boundary. In CVE-2021-22991, the F5 BIG-IP Traffic Management Microkernel (TMM) performs URI normalization on incoming requests but fails to properly restrict buffer operations, allowing specially crafted requests to trigger an out-of-bounds write that leads to denial of service or potentially remote code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2021-22991 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating, reflecting the extreme danger this vulnerability poses to organizations. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, meaning any attacker with network access to a BIG-IP virtual server can exploit it. Confidentiality, integrity, and availability impacts are all rated HIGH, indicating that successful exploitation can lead to complete system compromise including data theft, unauthorized modification, and full service disruption. The EPSS score of 73.10% (98.77th percentile) indicates a very high probability of exploitation. Given that F5 BIG-IP devices are critical infrastructure components that typically handle traffic for entire application environments, a compromise of these devices can have cascading effects across the organization.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-22991 in the wild by listing it in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-02-01. The EPSS score of 73.10% (98.77th percentile) indicates a very high probability of exploitation. While the NVD references do not include entries specifically tagged as public exploits, the F5 vendor advisory at K56715231 provides detailed technical information about the vulnerability, and the critical CVSS score combined with the low attack complexity makes exploit development straightforward for sophisticated threat actors. F5 BIG-IP devices are high-value targets for attackers due to their position in network infrastructure, and organizations should assume active targeting.
Remediation
- Apply F5 security updates immediately as required by CISA KEV directive. Upgrade to the fixed BIG-IP versions: 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 (or later) as described in F5 advisory K56715231.
- Identify and patch all affected BIG-IP modules across your environment. The vulnerability affects numerous product modules including Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, Analytics, Application Security Manager, DDoS Hybrid Defender, Domain Name System, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager, and SSL Orchestrator.
- Implement interim mitigations if immediate patching is not feasible. Restrict management and virtual server access to trusted networks only. Review and tighten URL-based access control policies, and implement additional network segmentation to limit exposure of BIG-IP virtual servers to untrusted traffic.
- Monitor BIG-IP systems for indicators of compromise by reviewing TMM crash logs, core dump files, and system logs for evidence of exploitation attempts. Check for unexpected configuration changes, unauthorized administrative access, and anomalous traffic patterns through BIG-IP devices.
- Harden BIG-IP deployments by disabling unnecessary services, restricting management interface access to dedicated management networks, enabling audit logging, and implementing regular configuration backup and integrity monitoring.
Technical Details
CVE-2021-22991 is a buffer overflow vulnerability (CWE-119) in the F5 BIG-IP Traffic Management Microkernel (TMM), the core traffic processing engine of BIG-IP devices. The vulnerability manifests during URI normalization of incoming requests to virtual servers, where specially crafted requests can cause the TMM to write beyond the intended buffer boundaries. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the maximum exploitability profile: network-accessible, low complexity, no privileges or user interaction required, with complete impact across confidentiality, integrity, and availability. The buffer overflow in the URI normalization process can be leveraged to cause a denial-of-service condition through TMM crashes, bypass URL-based access controls by manipulating how the TMM processes request URIs, or in certain configurations, achieve remote code execution on the BIG-IP device.
Frequently Asked Questions
Is CVE-2021-22991 being actively exploited?
Yes. CVE-2021-22991 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 73.10% (98.77th percentile) indicates a very high probability of exploitation, and federal agencies were required to remediate by 2022-02-01.
What products are affected by CVE-2021-22991?
CVE-2021-22991 affects F5 BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3. The vulnerability impacts all BIG-IP modules including Access Policy Manager, Application Security Manager, Local Traffic Manager, Advanced Firewall Manager, and numerous others.
How do I fix CVE-2021-22991?
Upgrade to the fixed BIG-IP versions: 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 as detailed in F5 advisory K56715231. If immediate patching is not possible, restrict network access to BIG-IP virtual servers and implement additional network segmentation.
How severe is CVE-2021-22991?
CVE-2021-22991 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. The vulnerability allows unauthenticated remote exploitation that can lead to denial of service, access control bypass, or potentially remote code execution on F5 BIG-IP devices, which are critical network infrastructure components.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.