CVE-2023-45886: F5 Big-ip Next DOS Vulnerability

CVE-2023-45886 Overview

CVE-2023-45886 is a Denial of Service vulnerability affecting the BGP daemon (bgpd) in IP Infusion ZebOS through version 7.10.6. Remote attackers can exploit this flaw by sending crafted BGP update messages containing malformed attributes, causing the BGP daemon to crash and disrupting network routing operations. This vulnerability impacts critical network infrastructure components across multiple F5 BIG-IP products that utilize the affected ZebOS BGP implementation.

Critical Impact

Remote attackers can disrupt BGP routing infrastructure by sending specially crafted BGP update messages, potentially causing widespread network outages in enterprise and service provider environments.

Affected Products

• IP Infusion ZebOS through version 7.10.6
• F5 BIG-IP Next version 20.0.1
• F5 BIG-IP Next Service Proxy for Kubernetes
• F5 BIG-IP Next Cloud-Native Network Functions
• F5 BIG-IP Local Traffic Manager
• F5 BIG-IP Global Traffic Manager

Discovery Timeline

• 2023-11-21 - CVE-2023-45886 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-45886

Vulnerability Analysis

This vulnerability exists in the BGP daemon's handling of BGP UPDATE messages. When the daemon receives a BGP UPDATE message containing a malformed path attribute, it fails to properly validate the attribute data before processing. This improper input validation causes the daemon to enter an error state that results in process termination, effectively disrupting BGP session establishment and maintenance with peer routers.

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker who has established a BGP peering session (or can inject packets into an existing session) can send malicious UPDATE messages that trigger the vulnerability. The impact is limited to availability—there is no compromise of confidentiality or integrity—but the disruption to BGP routing can have cascading effects on network connectivity.

Root Cause

The root cause is improper input validation in the BGP daemon's UPDATE message parser. Specifically, the bgpd process does not adequately validate path attribute fields according to RFC 4271 specifications before attempting to process them. When malformed attributes are encountered, the daemon fails to handle the error condition gracefully, leading to a crash rather than properly rejecting the malformed message and maintaining session stability.

Attack Vector

The attack is network-based and requires the attacker to be able to send BGP messages to the vulnerable daemon. This typically requires either:

1. An established BGP peering relationship with the target router
2. The ability to inject spoofed BGP packets that appear to originate from a legitimate peer
3. A compromised intermediate network position that allows modification of BGP traffic

The attacker crafts a BGP UPDATE message with a malformed path attribute—such as an attribute with an invalid length field, unexpected flags, or corrupted data in the attribute value. When the vulnerable bgpd processes this message, it crashes, terminating all BGP sessions on that router and potentially causing route convergence issues across the network.

For detailed technical analysis of BGP path attribute error handling issues, see the Benjojo Blog Post and the CERT Vulnerability Report.

Detection Methods for CVE-2023-45886

Indicators of Compromise

• Unexpected BGP daemon crashes or restarts in system logs
• Repeated BGP session flaps with specific peer routers
• Syslog messages indicating malformed BGP UPDATE messages received
• Core dumps or crash files generated by the bgpd process

Detection Strategies

• Monitor BGP daemon process stability using process monitoring tools and alert on unexpected restarts
• Implement BGP session monitoring to detect rapid session flapping or unexpected terminations
• Deploy network intrusion detection rules to identify malformed BGP UPDATE messages
• Review BGP logs for messages indicating attribute parsing errors or invalid path attributes

Monitoring Recommendations

• Configure centralized logging for all BGP-enabled devices and correlate session state changes
• Set up SNMP traps for BGP session state transitions to detect potential attack activity
• Monitor system resource utilization on routers to detect potential DoS conditions
• Implement netflow or sflow analysis to track unusual BGP traffic patterns

How to Mitigate CVE-2023-45886

Immediate Actions Required

• Review the F5 Technical Article for vendor-specific guidance and patch availability
• Implement BGP session authentication using MD5 or TCP-AO to prevent unauthorized peers from establishing sessions
• Apply network access controls to restrict BGP peering to known, trusted IP addresses only
• Enable BGP TTL Security (GTSM) to limit BGP messages to directly connected peers where applicable

Patch Information

Affected organizations should consult vendor-specific resources for patch availability:

• IP Infusion ZebOS: Review the IP Infusion Documentation for updated software versions that address this vulnerability
• F5 BIG-IP Products: Refer to the F5 Technical Article for specific hotfix and version upgrade guidance

Upgrade to patched versions as they become available from your respective vendors.

Workarounds

• Implement strict BGP session authentication (MD5 or TCP-AO) to prevent unauthorized peers from sending malformed messages
• Configure infrastructure ACLs to limit BGP traffic to known peer addresses only
• Enable BGP TTL Security Hack (GTSM) to restrict BGP sessions to directly connected neighbors
• Consider deploying BGP route servers or monitoring proxies that can filter malformed messages before they reach production routers

# Example: Enable BGP MD5 authentication (Cisco IOS syntax for reference)
router bgp 65001
 neighbor 192.168.1.1 password YOUR_SECURE_PASSWORD
 neighbor 192.168.1.1 ttl-security hops 1