K35358312 : TCP vulnerability CVE-2015-8099

Security Advisory Description

Under limited conditions, an invalid TCP segment can lead to a Denial of Service for the High-Speed Bridge (HSB) on the following platforms: 3900, 6900, 8900, 8950, 11000, 11050, PB100 or PB200. This issue is only exposed on virtual servers while Software SYN cookies are configured for use and currently engaged. The scope of the exposure is limited to the BIG-IP data plane. The access vector is network based and authentication is not a requirement for attack. There is no control plane exposure to this issue. (CVE-2015-8099)

Note: The affected platforms do not support the Hardware SYN cookie protection feature. This feature appears in the profile configuration; however, it is not configurable for the noted platforms. For more information about SYN cookie protection, refer to K14779: Overview of BIG-IP SYN cookie protection (11.3.x - 12.x).
Impact
Invalid TCP segment can lead to a denial-of-service (DoS) for BIG-IP platforms that contain the High-Speed Bridge (HSB).