Last Modified: Nov 07, 2022
Affected Product:
See more info
BIG-IP LTM
Known Affected Versions:
11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.10, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1
Fixed In:
11.6.0, 11.5.4 HF2, 11.4.1 HF4
Opened: Mar 28, 2014
Severity: 2-Critical
Related Article:
K16432
If SPDY has a stalled stream and it is being aborted, it may cause the TMM to crash due to referencing cleared state. 100 Continue messages appeared in response bodies. 100 Continue responses sent in the same packet as the response could stall the stream.
Traffic disrupted while tmm restarts.
SPDY aborts due to a miss-ordered event. SPDY then sees egress, and marks the stream as stalled. SPDY aborts the connection to the client, and marks the stream as unknown. Finally, the stream aborts again and dereferences the NULL pointer to the client when it tries to unstall itself. A 100 Continue message in a response, either by itself, or in the same packet as the response body.
This issue has no workaround at this time.
SPDY will no longer cause a TMM crash when it aborts, followed by egress, followed by a second abort. SPDY will handle 100 Continue messages correctly by ignoring them.