K31523465 : BIG-IP TMM vulnerability CVE-2022-41983

Security Advisory Description

While Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions cause the BIG-IP system to send data unencrypted, even with an SSL profile applied. (CVE-2022-41983)

Impact

This vulnerability may expose confidential information to a man-in-the-middle attacker, as data is sent without required encryption. Since this vulnerability results in a TLS record with a bad MAC, the connection will typically be aborted due to failed MAC verification after decrypt.

This vulnerability applies to the following platforms:

• B4450N (A114)
• i4000 (C115)
• i10000 (C116/C127)
• i7000 (C118)
• i5000 (C119)
• i11000 (C123)
• i11000-DS (C124)
• i15000 (D116)
• 2000 (C112)
• 4000 (C113)
• F5 rSeries
• F5 VELOS
• BIG-IP Virtual Edition on Hypervisors with Intel Processors, when configured to use Intel QAT.