CVE-2020-5929: F5 BIG-IP APM Information Disclosure Flaw

CVE-2020-5929 Overview

CVE-2020-5929 is a cryptographic timing vulnerability affecting F5 BIG-IP platforms equipped with Cavium Nitrox SSL hardware acceleration cards. The vulnerability exists in the handling of TLS/SSL handshakes when using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange. When the "Single DH use" option is not enabled and a Pre-Master Secret (PMS) begins with a zero byte, the system returns different error messages that can be exploited as a side-channel oracle attack, potentially allowing attackers to recover plaintext messages from encrypted communications.

Critical Impact

This vulnerability enables potential plaintext recovery from encrypted TLS/SSL communications through a padding oracle attack, compromising the confidentiality of sensitive data transmitted through affected BIG-IP devices.

Affected Products

• F5 BIG-IP Access Policy Manager versions 11.6.1-11.6.2, 12.1.0-12.1.2 HF1, 13.0.0-13.0.0 HF2
• F5 BIG-IP Local Traffic Manager versions 11.6.1-11.6.2, 12.1.0-12.1.2 HF1, 13.0.0-13.0.0 HF2
• F5 BIG-IP Application Security Manager versions 11.6.1-11.6.2, 12.1.0-12.1.2 HF1, 13.0.0-13.0.0 HF2
• F5 BIG-IP Advanced Firewall Manager versions 11.6.1-11.6.2, 12.1.0-12.1.2 HF1, 13.0.0-13.0.0 HF2
• F5 SSL Orchestrator versions 11.6.1-11.6.2, 12.1.0-12.1.2 HF1, 13.0.0-13.0.0 HF2

Discovery Timeline

• September 25, 2020 - CVE-2020-5929 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-5929

Vulnerability Analysis

This vulnerability is classified as CWE-203 (Observable Discrepancy), a type of side-channel attack where an application leaks information through observable differences in behavior. The flaw specifically manifests in BIG-IP platforms utilizing Cavium Nitrox SSL hardware acceleration cards for cryptographic operations.

When a Virtual Server is configured with a Client SSL profile using ADH (Anonymous Diffie-Hellman) or DHE (Ephemeral Diffie-Hellman) key exchange without the "Single DH use" option enabled, the system exhibits different error message behaviors during TLS handshakes. If the Pre-Master Secret begins with a zero byte (0x00), the error messages returned differ from those returned for non-zero-byte PMS values.

An attacker can exploit this behavioral difference as an oracle to systematically determine the Pre-Master Secret value. Combined with precise timing measurements, an attacker could potentially recover the plaintext of encrypted communications. This attack requires network access to the target BIG-IP device and the ability to observe TLS handshake responses.

Root Cause

The root cause lies in improper implementation of constant-time error handling within the Cavium Nitrox SSL hardware acceleration card's cryptographic operations. When processing Diffie-Hellman key exchanges, the code path diverges based on the leading byte of the Pre-Master Secret, causing observable timing differences and distinct error messages. This violates cryptographic best practices that require identical behavior regardless of secret values to prevent side-channel attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker must be able to initiate TLS connections to the vulnerable BIG-IP Virtual Server and observe the resulting error messages and timing characteristics.

The attack proceeds as follows: The attacker sends crafted TLS ClientHello messages with manipulated Diffie-Hellman parameters designed to produce Pre-Master Secrets with specific leading byte patterns. By analyzing the differences in error responses and timing, the attacker can iteratively determine the actual Pre-Master Secret value. Once recovered, this secret can be used to decrypt captured TLS session traffic.

This attack is related to the broader class of Bleichenbacher-style oracle attacks against TLS implementations, which have historically been used to break the confidentiality of SSL/TLS communications.

Detection Methods for CVE-2020-5929

Indicators of Compromise

• Unusual patterns of failed TLS handshakes from single source IPs attempting DHE/ADH cipher suites
• High volume of connection attempts with varying Diffie-Hellman parameters from the same client
• Anomalous timing patterns in TLS handshake responses indicating potential oracle probing

Detection Strategies

• Monitor for excessive TLS handshake failures using DHE or ADH cipher suites on BIG-IP Virtual Servers
• Implement network intrusion detection rules to identify Bleichenbacher-style attack patterns against TLS endpoints
• Review BIG-IP logs for repeated connection attempts from single sources targeting SSL profiles

Monitoring Recommendations

• Enable detailed SSL/TLS logging on affected BIG-IP devices to capture handshake failures and associated timing data
• Deploy network monitoring to baseline normal TLS handshake patterns and alert on statistical anomalies
• Integrate BIG-IP security event logs with SIEM solutions for correlation and advanced threat detection

How to Mitigate CVE-2020-5929

Immediate Actions Required

• Upgrade affected F5 BIG-IP systems to patched versions as specified in F5 Support Article K91158923
• Enable the "Single DH use" option in Client SSL profiles to regenerate DH parameters for each handshake
• Consider disabling ADH and DHE cipher suites if not required for business operations
• Audit all Virtual Server configurations using Client SSL profiles with Cavium Nitrox hardware acceleration

Patch Information

F5 has released security patches addressing this vulnerability. Organizations should consult the F5 Support Article K91158923 for specific patch versions and upgrade instructions. Affected versions include:

• Version 13.0.0 through 13.0.0 HF2
• Version 12.1.0 through 12.1.2 HF1
• Version 11.6.1 through 11.6.2

Workarounds

• Enable the "Single DH use" option in the Client SSL profile options list to force regeneration of DH parameters for each connection
• Disable ADH (Anonymous Diffie-Hellman) and DHE (Ephemeral Diffie-Hellman) cipher suites if not operationally required
• Configure the Virtual Server to use alternative key exchange mechanisms such as ECDHE that are not affected by this vulnerability

# Example TMSH configuration to enable Single DH use
tmsh modify ltm profile client-ssl <profile_name> options { single-dh-use }

# Verify the configuration
tmsh list ltm profile client-ssl <profile_name> options