Bug ID 756402: Re-transmitted IPsec packets can have garbled contents

Last Modified: Oct 16, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4

Fixed In:
15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3

Opened: Jan 24, 2019

Severity: 2-Critical

Symptoms

Before re-transmitting a packet, it is discovered to be garbled, mainly in the form of having physical length that no longer matches the logical length recorded inside the packet.

Impact

Likely tunnel outage until re-established.

Conditions

Possibly rare condition that might cause packet freeing while still in use.

Workaround

No workaround is known at this time.

Fix Information

This release adds checksums to verify IPsec packets are not altered between first creation and later re-transmission.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips