Bug ID 763121: Utilizing the AFM Packet Tester tool while a TCP Half Open attack is underway can crash TMM.

Last Modified: Apr 10, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP AFM(all modules)

Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3

Opened: Mar 21, 2019
Severity: 2-Critical

Symptoms

TMM crashes and produces a core file. The crash is a SIGFPE accompanied by the following panic string: Assertion "packet must already have an ethernet header" failed.

Impact

Traffic disrupted while tmm restarts.

Conditions

This issue occurs when all of the following conditions are met: - The system is provisioned for AFM. - A TCP Half Open attack to the system is underway. - A BIG-IP Administrator attempts to use the AFM Packet Tester tool, and simulates sending a TCP segment with the SYN flag set.

Workaround

Do not use the AFM Packet Tester tool while a TCP Half Open attack is underway.

Fix Information

None

Behavior Change