CVE-2026-39458

Executive Summary

CVE-2026-39458 is a high-severity denial-of-service (DoS) vulnerability affecting F5 BIG-IP systems with a DNS profile that has DNS cache enabled. An unauthenticated attacker can send specially crafted traffic to a vulnerable virtual server, causing the Traffic Management Microkernel (TMM) to terminate. This results in a complete loss of availability for all services handled by that TMM instance. The vulnerability has a CVSS score of 7.5 (High) and currently has no known public exploit, patch, or proof-of-concept code. The vendor has not released a fix, and software versions that have reached End of Technical Support (EoTS) are not evaluated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Complete TMM termination leads to service outage.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it a significant risk for organizations using BIG-IP DNS caching.

Deep Dive & Mechanics

The vulnerability resides in the DNS caching functionality of the BIG-IP Traffic Management Microkernel (TMM). When a DNS profile with caching enabled is configured on a virtual server, the system processes incoming DNS queries and caches responses to improve performance. The flaw is triggered by "undisclosed traffic" – likely a malformed or specially crafted DNS query that causes a memory corruption or logic error in the caching module. This leads to a segmentation fault or kernel panic in TMM, causing it to terminate abruptly.

Root Cause: Improper input validation (CWE-20) in the DNS cache handling code. The system fails to sanitize or validate certain fields in incoming DNS packets before processing them through the cache logic.

Impact: When TMM terminates, all virtual services handled by that TMM instance become unavailable. This includes not only DNS services but also any other applications (HTTP, SSL, etc.) running on the same TMM. The system may automatically restart TMM, but this can cause repeated service interruptions.

Affected Component: BIG-IP DNS profile with DNS cache enabled. The vulnerability does not affect systems without DNS caching or with DNS profiles that do not use caching.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is in the DNS cache module of TMM. Without vendor-supplied patched code, a comparison cannot be made. However, the fix would likely involve adding input validation and bounds checking for DNS packet fields before they are processed by the cache.

Hypothetical vulnerable code pattern (pseudocode):

void process_dns_query(dns_packet *pkt) {
    // No validation of pkt->question_count or pkt->answer_count
    cache_entry *entry = lookup_cache(pkt->question);
    if (entry) {
        // Unsafe memory copy
        memcpy(cache_buffer, pkt->payload, pkt->payload_length);
    }
}

Hypothetical patched code pattern:

void process_dns_query(dns_packet *pkt) {
    if (pkt->question_count > MAX_QUESTIONS || pkt->answer_count > MAX_ANSWERS) {
        return; // Reject malformed packet
    }
    if (pkt->payload_length > MAX_PAYLOAD_SIZE) {
        return; // Reject oversized payload
    }
    cache_entry *entry = lookup_cache(pkt->question);
    if (entry) {
        // Safe memory copy with bounds checking
        memcpy(cache_buffer, pkt->payload, min(pkt->payload_length, MAX_PAYLOAD_SIZE));
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target BIG-IP system with a DNS profile that has DNS cache enabled.
• Network access to the virtual server's DNS port (typically UDP 53).

Exploitation Steps:

1. Reconnaissance: Use Shodan or Nmap to identify BIG-IP systems with DNS services. Look for banners or responses indicating F5 BIG-IP.
2. Craft Malformed DNS Query: Create a DNS query with a malformed header or payload. The exact trigger is undisclosed, but likely involves:
   • An abnormally large number of questions or answers.
   • A malformed compression pointer.
   • A DNS query with a specially crafted transaction ID or flags.
3. Send Traffic: Use a tool like Scapy or a custom Python script to send the crafted DNS query to the target's virtual server IP on UDP port 53.
4. Verify Impact: Monitor the target for TMM termination. If successful, the DNS service (and other services on the same TMM) will become unresponsive.

Example Scapy script (conceptual):

from scapy.all import *
target_ip = "192.0.2.10"
# Craft a malformed DNS query (example: oversized question count)
packet = IP(dst=target_ip)/UDP(dport=53)/DNS(rd=1, qd=DNSQR(qname="example.com", qtype="A"))
# Modify packet to trigger vulnerability (e.g., set qdcount to a large value)
packet[DNS].qdcount = 65535
send(packet)

Note: This is a conceptual example. The exact payload required to trigger the vulnerability is not publicly known.

Blue Team (Defense & Detection)

Detection:

• Monitor for sudden TMM restarts or crashes in BIG-IP logs (/var/log/tmm).
• Look for DNS queries with abnormal header fields (e.g., high question/answer counts, malformed compression pointers).
• Use network monitoring to detect unusual DNS traffic patterns targeting BIG-IP systems.

Mitigation:

• Disable DNS caching on BIG-IP DNS profiles if not essential.
• Apply network access controls to restrict DNS traffic to trusted sources only.
• Monitor F5's security advisories for a patch and apply it as soon as available.
• Consider using a Web Application Firewall (WAF) or DNS firewall to filter malformed queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • DNS queries with abnormally high question counts (>1000).
  • DNS queries with malformed compression pointers (offset > 16383).
  • Repeated DNS queries from a single source IP to a BIG-IP virtual server.
• System IOCs:
  • TMM crash logs in /var/log/tmm containing segmentation fault or kernel panic entries.
  • Sudden service unavailability for all virtual servers on the same TMM.
  • BIG-IP system logs showing "TMM terminated unexpectedly" or similar messages.
• File IOCs:
  • Core dump files in /var/core/ related to TMM.

Detection Engineering

YARA Rule

rule CVE_2026_39458_DNS_Malformed {
    meta:
        description = "Detects malformed DNS queries targeting BIG-IP DNS cache vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-39458"
    strings:
        $dns_header = { ?? ?? 10 00 00 01 00 00 00 00 00 00 }  // Standard DNS query header
        $high_qdcount = { ?? ?? [4-8] 00 01 00 00 00 00 00 00 } // QDCOUNT > 1000
        $malformed_ptr = { c0 [0-9a-f] [0-9a-f] } // Compression pointer with offset > 16383
    condition:
        $dns_header and ($high_qdcount or $malformed_ptr)
}

Sigma Rule

title: CVE-2026-39458 - BIG-IP DNS Cache DoS
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects malformed DNS queries targeting BIG-IP DNS cache vulnerability
author: Valters IT
logsource:
    category: network
    product: dns
detection:
    selection:
        dns.question_count: >1000
        dns.answer_count: >1000
        dns.compression_pointer_offset: >16383
    condition: selection
falsepositives:
    - Legitimate DNS queries with high question counts (rare)
level: high

Suricata Rule

alert udp any any -> any 53 (msg:"CVE-2026-39458 - BIG-IP DNS Cache DoS Attempt"; content:"|00 00 10 00 00 01 00 00 00 00 00 00|"; offset:0; depth:12; byte_test:4,>,1000,4,relative; byte_test:4,>,1000,8,relative; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable DNS caching on all BIG-IP DNS profiles that do not require it. This can be done via the BIG-IP Configuration utility or CLI:

   tmsh modify ltm profile dns <profile_name> cache disable
   

2. Restrict network access to BIG-IP virtual servers using DNS profiles. Use ACLs or firewall rules to allow only trusted DNS resolvers and clients.
3. Monitor for TMM crashes and investigate any sudden service outages.

Long-term Actions:

1. Apply vendor patch when released by F5. Monitor F5 security advisories (https://support.f5.com).
2. Upgrade to a supported version if currently running an EoTS version.
3. Implement DNS traffic filtering using a DNS firewall or WAF to block malformed queries.
4. Conduct regular security assessments of BIG-IP configurations.

Workaround: If DNS caching is critical, consider using a separate BIG-IP instance for DNS services to isolate the impact of a potential crash.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert