CVE-2021-23032 Denial of service in BIG-IP DNS

What is CVE-2021-23032?

CVE-2021-23032 is a high-severity denial of service vulnerability in F5 Big-Ip Domain Name System, published on 14 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured with non-default Wide IP and pool settings, undisclosed DNS responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness: CWE-20

Which versions are affected by CVE-2021-23032?

It affects 1 product.

Products include F5 Big-Ip Domain Name System.

How do I fix CVE-2021-23032?

No fix has been published for CVE-2021-23032 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-23032 being exploited?

There is no known exploitation of CVE-2021-23032 in the wild and no public exploit code.

Other vulnerabilities in F5 Big-Ip Domain Name System

• CVE-2022-23013 Cross-site scripting in BIG-IP DNS & GTM High 8.8
• CVE-2026-40061 iControl REST and tmsh vulnerability High 8.5
• CVE-2022-41787 BIG-IP DNS Express vulnerability CVE-2022-41787 High 7.5
• CVE-2020-27717 Denial of service in BIG-IP DNS High 7.5
• CVE-2020-27721 Denial of service in BIG-IP GTM & DNS High 7.5

All F5 Big-Ip Domain Name System vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f2hj-jpwp-p6pp.