Application Logic Abuse in BIG-IP (ASM) REST Endpoints Leading to System Instability and OOM Killer Trigger

CVE-2019-6637 · MEDIUM Severity

AV:N/AC:L/AU:S/C:N/I:N/A:P

On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on arbitrary processes. The attack requires an authenticated user with role of "Guest" or greater privilege. Note: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack.

Learn more about our Cis Benchmark Audit For Distribution Independent Linux.