CVE-2021-22974: Race Condition

Q: What is the severity of CVE-2021-22974?

CVE-2021-22974 is rated as a critical severity vulnerability that could allow an authenticated attacker to execute commands on the affected systems.

Q: How do I fix CVE-2021-22974?

To fix CVE-2021-22974, you should upgrade affected softwares to the latest versions provided by F5, specifically versions 16.0.1.1 and above, 15.1.2 and above, 14.1.3.1 and above, or 13.1.3.6 and above.

Q: Which F5 products are affected by CVE-2021-22974?

CVE-2021-22974 affects several F5 products including BIG-IP Access Policy Manager, Advanced Firewall Manager, and other module versions listed in the CVE report.

Q: Can CVE-2021-22974 be exploited remotely?

No, CVE-2021-22974 requires authentication to iControl REST and therefore cannot be exploited remotely by unauthenticated users.

Q: Is there a workaround for CVE-2021-22974?

Currently, the recommended approach is to apply the necessary updates as there are no documented workarounds for CVE-2021-22974.

Published Feb 12, 2021

Updated

On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected Software

58 affected components

F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.6

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.3.1

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.2

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1

F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.5

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.3.1

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.2

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1

F5 Big-ip Advanced Web Application Firewall>=13.1.0<13.1.3.6

F5 Big-ip Advanced Web Application Firewall>=14.1.0<14.1.3.1

F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.2

F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1.1

F5 BIG-IP Analytics>=13.1.0<13.1.3.6

F5 BIG-IP Analytics>=14.1.0<14.1.3.1

F5 BIG-IP Analytics>=15.1.0<15.1.2

F5 BIG-IP Analytics>=16.0.0<16.0.1.1

F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.6

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.3.1

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.2

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1

F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.6

F5 BIG-IP Application Security Manager>=14.1.0<14.1.3.1

F5 BIG-IP Application Security Manager>=15.1.0<15.1.2

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1

F5 Big-ip Ddos Hybrid Defender>=13.1.0<13.1.3.6

F5 Big-ip Ddos Hybrid Defender>=14.1.0<14.1.3.1

F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.2

F5 Big-ip Ddos Hybrid Defender>=16.0.0<16.0.1.1

F5 Big-ip Domain Name System>=13.1.0<13.1.3.6

F5 Big-ip Domain Name System>=14.1.0<14.1.3.1

F5 Big-ip Domain Name System>=15.1.0<15.1.2

F5 Big-ip Domain Name System>=16.0.0<16.0.1.1

F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.5

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.3.1

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.2

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1

F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.6

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.3.1

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.2

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Link Controller>=13.1.0<13.1.3.6

F5 Big-ip Link Controller>=14.1.0<14.1.3.1

F5 Big-ip Link Controller>=15.1.0<15.1.2

F5 Big-ip Link Controller>=16.0.0<16.0.1.1

F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.6

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.3.1

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.2

F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.6

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.3.1

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.2

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1

F5 BIG-IP SSL Orchestrator>=13.1.0<13.1.3.6

F5 BIG-IP SSL Orchestrator>=14.1.0<14.1.3.1

F5 BIG-IP SSL Orchestrator>=15.1.0<15.1.2

F5 BIG-IP SSL Orchestrator>=16.0.0<16.0.1.1

F5 BIG-IQ Centralized Management>=6.0.0<=6.1.0

F5 BIG-IQ Centralized Management>=7.0.0<=7.1.0

Event History

Feb 12, 2021

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-22974?

CVE-2021-22974 is rated as a critical severity vulnerability that could allow an authenticated attacker to execute commands on the affected systems.

How do I fix CVE-2021-22974?

To fix CVE-2021-22974, you should upgrade affected softwares to the latest versions provided by F5, specifically versions 16.0.1.1 and above, 15.1.2 and above, 14.1.3.1 and above, or 13.1.3.6 and above.

Which F5 products are affected by CVE-2021-22974?