K000133467 : BIG-IP HTTP/2 vulnerability CVE-2023-40534

Security Advisory Description

Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server. TMM can also terminate when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled, regardless of the presence of the iRule. (CVE-2023-40534)

Impact

Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote, unauthenticated attacker to cause a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.