title: BIG-IP PEM vulnerability
description:
When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue affects classification engines using signatures released between 09-08-2022 and 02-16-2023. See the table in the F5 Security Advisory for a complete list of affected classification signature files.  NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
problem types: CWE-121 Stack-based Buffer Overflow
affected:
{
defaultStatus: unknown
modules: PEM
product: BIG-IP
vendor: F5
versions:
changes: [at: classification-update-17.0.0-20220919_0728.im, status: affected], lessThan: *, status: unaffected, version: 17.0.0, versionType: custom
changes: [at: classification-update-16.1.0-20220919_0728.im, status: affected], lessThan: *, status: unaffected, version: 16.1.0, versionType: custom
changes: [at: classification-update-15.1.0-20220919_0728.im, status: affected], lessThan: *, status: unaffected, version: 15.1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL