CVE-2022-23012: Double Free

Q: What is the severity of CVE-2022-23012?

The severity of CVE-2022-23012 is classified as critical due to its potential impact on the Traffic Management Microkernel.

Q: How do I fix CVE-2022-23012?

To fix CVE-2022-23012, upgrade to BIG-IP versions 15.1.4.1 or 14.1.4.5 or later.

Q: Which versions are affected by CVE-2022-23012?

CVE-2022-23012 affects BIG-IP versions 15.1.x prior to 15.1.4.1 and 14.1.x prior to 14.1.4.5.

Q: What components are vulnerable in CVE-2022-23012?

The components vulnerable to CVE-2022-23012 include F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, and Local Traffic Manager among others.

Q: Can undisclosed requests trigger issues in CVE-2022-23012?

Yes, undisclosed requests can cause the Traffic Management Microkernel to terminate as noted in CVE-2022-23012.

Published Jan 25, 2022

Updated

On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

22 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.4.5

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.4.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.4.5

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.4.1

F5 BIG-IP Analytics>=14.1.0<14.1.4.5

F5 BIG-IP Analytics>=15.1.0<15.1.4.1

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.4.5

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.4.1

F5 BIG-IP Application Security Manager>=14.1.0<14.1.4.5

F5 BIG-IP Application Security Manager>=15.1.0<15.1.4.1

F5 Big-ip Domain Name System>=14.1.0<14.1.4.5

F5 Big-ip Domain Name System>=15.1.0<15.1.4.1

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.4.5

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.4.1

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.4.5

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.4.1

F5 Big-ip Link Controller>=14.1.0<14.1.4.5

F5 Big-ip Link Controller>=15.1.0<15.1.4.1

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.4.5

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.4.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.4.5

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.4.1

Event History

Jan 25, 2022

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-23012?

The severity of CVE-2022-23012 is classified as critical due to its potential impact on the Traffic Management Microkernel.

How do I fix CVE-2022-23012?

To fix CVE-2022-23012, upgrade to BIG-IP versions 15.1.4.1 or 14.1.4.5 or later.

Which versions are affected by CVE-2022-23012?