Last Modified: Apr 17, 2024
Affected Product(s):
BIG-IP LTM, TMOS
Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 14.1.5.4, 14.1.5.6, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 17.0.0, 17.0.0.1, 17.0.0.2
Opened: May 07, 2021 Severity: 3-Major
Keeping a variable reference to FLOW::this or FLOW::peer in iRules can result in zombie connection flows that are never removed. TMM memory use for 'connflow' and 'tclrule_pcb' are high, and do not match the number of current connections reported by the system.
Increased memory use in TMM, which can eventually result in a TMM crash or traffic disruption while connections are removed using the connection sweeper.
-- iRule that uses FLOW::this or FLOW::peer, and stores the result of one of those commands into a variable.
Do not retain the result of 'FLOW::this' or 'FLOW::peer' in a variable in an iRule. Instead, either: 1. Use the variable directly, i.e.: log local0.warning: "The flow is [FLOW::this]" 2. Unset the variable when done, i.e.: set flow [FLOW::this] log local0.warning: "The flow is $flow" unset flow If a system is already affected by this issue, the only way to free that memory is to restart TMM.
None