CyberSecBulletin
CVE-2023-22839NVD status: Modified

BIG-IP: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2023-22839 is a high-severity NULL pointer dereference vulnerability in BIG-IP from F5, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 17.0.0.2, 16.1.3.3, 15.1.8.1 as the first without the flaw, so updating BIG-IP to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.64% chance of exploitation within 30 days, higher than 51% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update BIG-IP to 17.0.0.2 or 16.1.3.3 or 15.1.8.1 or 14.1.5.3, whichever matches your release line, or a later version.
  2. Update Big-ip Domain Name System to 14.1.5.3 or 15.1.7 or 16.1.3.3 or 17.0.0.2, whichever matches your release line, or a later version.
  3. Update Big-ip Local Traffic Manager to 14.1.5.3 or 15.1.7 or 16.1.3.3 or 17.0.0.2, whichever matches your release line, or a later version.
  4. Read the advisory on my.f5.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
F5BIG-IP17.0.0 up to, but not including, 17.0.0.2; 16.1.0 up to, but not including, 16.1.3.3; 15.1.0 up to, but not including, 15.1.8.1; 14.1.0 up to, but not including, 14.1.5.3; 13.1.0 and later17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3
F5Big-ip Domain Name System13.1.0 through 13.1.5; 14.1.0 up to, but not including, 14.1.5.3; 15.1.0 up to, but not including, 15.1.7; 16.1.0 up to, but not including, 16.1.3.3; 17.0.0 up to, but not including, 17.0.0.214.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2
F5Big-ip Local Traffic Manager13.1.0 through 13.1.5; 14.1.0 up to, but not including, 14.1.5.3; 15.1.0 up to, but not including, 15.1.7; 16.1.0 up to, but not including, 16.1.3.3; 17.0.0 up to, but not including, 17.0.0.214.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2
F5Big-ip 10000s FirmwareNot specified in the recordNot stated
F5Big-ip 10200v FirmwareNot specified in the recordNot stated
F5Big-ip 10200v-ssl FirmwareNot specified in the recordNot stated
F5Big-ip 12000 FirmwareNot specified in the recordNot stated
F5Big-ip 5000s FirmwareNot specified in the recordNot stated
F5Big-ip 5200v FirmwareNot specified in the recordNot stated
F5Big-ip 5200v-ssl FirmwareNot specified in the recordNot stated
F5Big-ip 7000s FirmwareNot specified in the recordNot stated
F5Big-ip 7200v FirmwareNot specified in the recordNot stated
F5Big-ip 7200v-ssl FirmwareNot specified in the recordNot stated
F5Big-ip I10600 FirmwareNot specified in the recordNot stated
F5Big-ip I10800 FirmwareNot specified in the recordNot stated
F5Big-ip I11600 FirmwareNot specified in the recordNot stated
F5Big-ip I11800 FirmwareNot specified in the recordNot stated
F5Big-ip I15600 FirmwareNot specified in the recordNot stated
F5Big-ip I15800 FirmwareNot specified in the recordNot stated
F5Big-ip I5600 FirmwareNot specified in the recordNot stated
F5Big-ip I5800 FirmwareNot specified in the recordNot stated
F5Big-ip I7600 FirmwareNot specified in the recordNot stated
F5Big-ip I7800 FirmwareNot specified in the recordNot stated
F5R10600 FirmwareNot specified in the recordNot stated
F5R10800 FirmwareNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE; 10 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA (f5.com)
CVSS 3.17.5HighNVD

Official description

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in BIG-IP

All BIG-IP vulnerabilities

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.