-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2019.3234.3
      F5 products: Spectre SWAPGS gadget vulnerability CVE-2019-1125
                              20 August 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5 products
Publisher:         F5 Networks
Operating System:  Network Appliance
Impact/Access:     Access Privileged Data -- Existing Account
Resolution:        Mitigation
CVE Names:         CVE-2019-1125 CVE-2018-3693 

Reference:         ASB-2019.0229
                   ESB-2019.3128
                   ESB-2018.2343
                   ESB-2018.0113.5

Original Bulletin: 
   https://support.f5.com/csp/article/K31085564

Revision History:  August 20 2020: Fixes available for BIG-IP 14.x branch
                   July   14 2020: Updated Security Advisory Description
                   August 26 2019: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

K31085564:Spectre SWAPGS gadget vulnerability CVE-2019-1125

Security Advisory

Original Publication Date: 23 Aug, 2019

Latest   Publication Date: 13 Jul, 2020

Security Advisory Description

An information disclosure vulnerability exists when certain central processing
units (CPU) speculatively access memory, aka 'Windows Kernel Information
Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071,
CVE-2019-1073. (CVE-2019-1125 also known as Spectre SWAPGS gadget
vulnerability)

A Spectre gadget was found in the Linux kernel's implementation of system
interrupts. An attacker with unprivileged local access could use this
information to reveal private data through a Spectre-like side channel.

Impact

F5 continues to investigate the impact of the Spectre SWAPGS gadget
vulnerability on our products. F5 is focused on providing patched releases as
soon as we have fully tested and verified fixes. F5 will update this article
with the most current information as soon as it is confirmed.

BIG-IP

First and foremost, there is no exposure on BIG-IP products by way of the data
plane. All exposure is limited to the control plane (also known as the
management plane).

Furthermore, on the control plane, the vulnerability is exploitable only by
four authorized, authenticated account roles: Administrator, Resource
Administrator, Manager, and iRules Manager. You must be authorized to access
the system in one of these roles to even attempt to exploit the vulnerability.

This vulnerability requires an attacker who can provide and run binary code of
their choosing on the BIG-IP platform.

These conditions severely restrict the exposure risk of BIG-IP products.

For single-tenancy products, such as a standalone BIG-IP appliance, the risk is
limited to a local, authorized user using this vulnerability to read
information from memory that they would not normally be able to access,
exceeding their privileges. Effectively, the risk in a single-tenancy situation
is that a user may be able to access kernel-space memory, instead of being
limited to their own user-space.

For multi-tenancy environments, such as cloud, VE, and Virtual Clustered
Multiprocessing (vCMP), the same local risk applies as with single-tenancy
environments - local kernel memory access. Additionally, the risk of attacks
across guests exists, or attacks against the hypervisor/host. In cloud and VE
environments, preventing these new attacks falls on the hypervisor/host
platform, outside the scope of F5's ability to support or patch. Please contact
your cloud provider or hypervisor vendor to ensure that their platforms or
products are protected against this Spectre vulnerability.

For vCMP environments, F5 believes that while the Spectre SWAPGS gadget
vulnerability does offer a theoretical possibility of guest-to-guest or
guest-to-host attacks, these would be very difficult to successfully conduct in
the BIG-IP environment. 

F5 is working with our hardware component vendors to determine the scope of
this vulnerability across our various generations of hardware platforms. All of
the information we currently have from our vendors is represented in this
Security Advisory. 

We are also testing the fixes produced by the Linux community. We are
conducting an extensive test campaign to characterize the impact of the fixes
on system performance and stability to ensure, as best we can, a good
experience for our customers. We do not want to rush the process and release
fixes without a full understanding of any potential issues. Given the limited
exposure, as detailed above, the complexity of the fixes, and the potential
issues that we and others have seen, we believe a detailed approach is
warranted and that rushing a fix could result in an impact to system stability
or unacceptable performance costs. We will update this article with details of
our fixes as they become available.

To determine if this vulnerability affects a platform and the processor type
each platform uses, refer to the following table.

Note: In the following table, only one entry is shown for platform models that
may have several variants. For example, BIG-IP 11000, BIG-IP 11050, BIG-IP
11050F, and BIG-IP 11050N are all vulnerable and included in the table as
"BIG-IP 110x0". Some platforms may have multiple vendor processors, such as the
iSeries platforms, which have one or more Intel core processors and may have a
vulnerable ARM processor in one or more subsystems. F5 does not believe that
ARM processors in these subsystems are accessible to attackers, unless some
other code-execution vulnerability is present, but the information is being
provided out of an abundance of caution.

+-------------+-----------+---------------------------------------------------+
|Model        |Processor  |Vulnerable to CVE-2019-1125 Spectre SWAPGS gadget  |
|             |type       |vulnerability                                      |
+-------------+-----------+---------------------------------------------------+
|VIPRION B21x0|Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|VIPRION B2250|Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|VIPRION B4100|AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|VIPRION B4200|AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|VIPRION B43x0|Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|VIPRION B44x0|Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 800   |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 1600  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 3600  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 3900  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 2xx0  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 4xx0  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 5xx0  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 7xx0  |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 10xx0 |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 12xx0 |Intel      |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP i2x00 |Intel, ARM |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP i4x00 |Intel, ARM |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP i5x00 |Intel, ARM |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP i7x00 |Intel, ARM |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP i10x00|Intel, ARM |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 6400  |AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 6900  |AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 89x0  |AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+
|BIG-IP 110x0 |AMD        |Y                                                  |
+-------------+-----------+---------------------------------------------------+

Note: Platform models that have reached End of Technical Support (EoTS) will
not be evaluated. For more information, refer to K4309: F5 platform lifecycle
support policy.

BIG-IQ and Enterprise Manager 

Systems with microprocessors that use speculative execution and indirect branch
prediction may allow unauthorized disclosure of information to an attacker with
local user access by way of a side-channel analysis.

To determine if this vulnerability affects each platform and the processor type
each platform uses, refer to the following table.

+--------------------+------------+-------------------------------------------+
|Model               |Processor   |Vulnerable to CVE-2018-3693 Spectre-NG     |
|                    |type        |Variant 1.1                                |
+--------------------+------------+-------------------------------------------+
|BIG-IQ 7000         |Intel       |Y                                          |
+--------------------+------------+-------------------------------------------+
|Enterprise Manager  |Intel       |Y                                          |
|4000                |            |                                           |
+--------------------+------------+-------------------------------------------+

Note: Platform models that have reached End of Technical Support (EoTS) will
not be evaluated. For more information, refer to K4309: F5 platform lifecycle
support policy.

Traffix

Systems with microprocessors that use speculative execution and indirect branch
prediction may allow unauthorized disclosure of information to an attacker with
local user access by way of a side-channel analysis.

Security Advisory Status

F5 Product Development has assigned IDs 816413 and 816417 (BIG-IP), ID 816417-2
(BIG-IQ), and CPF-25123 (Traffix), to this vulnerability.

Note: F5 iWorkflow and Enterprise Manager have not yet been assigned IDs.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases, point releases, or
hotfixes that address the vulnerability, refer to the following table. For more
information about security advisory versioning, refer to K51812227:
Understanding Security Advisory versioning.

+---------------------+------+----------+----------+--------+------+----------+
|                     |      |Versions  |Fixes     |        |CVSSv3|Vulnerable|
|Product              |Branch|known to  |introduced|Severity|score^|component |
|                     |      |be        |in        |        |1     |or feature|
|                     |      |vulnerable|          |        |      |          |
+---------------------+------+----------+----------+--------+------+----------+
|                     |16.x  |None      |16.0.0    |        |      |          |
|                     +------+----------+----------+        |      |          |
|                     |15.x  |15.0.0 -  |15.0.1.4  |        |      |          |
|                     |      |15.1.0    |          |        |      |          |
|                     +------+----------+----------+        |      |          |
|BIG-IP (LTM, AAM,    |14.x  |14.0.0 -  |14.1.2.7  |        |      |          |
|AFM, Analytics, APM, |      |14.1.2    |          |        |      |          |
|ASM, DNS, Edge       +------+----------+----------+Medium  |5.9   |CPU, Linux|
|Gateway, FPS, GTM,   |13.x  |13.1.0 -  |None      |        |      |kernel    |
|Link Controller, PEM,|      |13.1.3    |          |        |      |          |
|WebAccelerator)      +------+----------+----------+        |      |          |
|                     |12.x  |12.1.0 -  |None      |        |      |          |
|                     |      |12.1.5    |          |        |      |          |
|                     +------+----------+----------+        |      |          |
|                     |11.x  |11.5.2 -  |None      |        |      |          |
|                     |      |11.6.5    |          |        |      |          |
+---------------------+------+----------+----------+--------+------+----------+
|Enterprise Manager   |3.x   |3.1.1     |None      |Medium  |5.9   |CPU, Linux|
|                     |      |          |          |        |      |kernel    |
+---------------------+------+----------+----------+--------+------+----------+
|                     |7.x   |7.0.0 -   |None      |        |      |          |
|                     |      |7.1.0     |          |        |      |          |
|                     +------+----------+----------+        |      |          |
|BIG-IQ Centralized   |6.x   |6.0.0 -   |None      |Medium  |5.9   |CPU, Linux|
|Management           |      |6.1.0     |          |        |      |kernel    |
|                     +------+----------+----------+        |      |          |
|                     |5.x   |5.1.0 -   |None      |        |      |          |
|                     |      |5.4.0     |          |        |      |          |
+---------------------+------+----------+----------+--------+------+----------+
|F5 iWorkflow         |2.x   |2.3.0     |None      |Medium  |5.9   |CPU, Linux|
|                     |      |          |          |        |      |kernel    |
+---------------------+------+----------+----------+--------+------+----------+
|Traffix SDC          |5.x   |5.0.0 -   |None      |Medium  |5.9   |CPU, Linux|
|                     |      |5.1.0     |          |        |      |kernel    |
+---------------------+------+----------+----------+--------+------+----------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Mitigation

BIG-IP

The only roles on a BIG-IP system that can exploit this vulnerability are the
Administrator, Resource Administrator, Manager, and iRules Manager roles. To
mitigate against this vulnerability, ensure that you limit access to these
roles to only trusted employees. For BIG-IP Virtual Editions deployed in a
publicly shared tenant virtual environment, contact your cloud provider to
ensure their platforms or products are protected against Spectre variants.

Supplemental Information

o K51812227: Understanding Security Advisory versioning
  o K41942608: Overview of Security Advisory articles
  o K4602: Overview of the F5 security vulnerability response policy
  o K4918: Overview of the F5 critical issue hotfix policy
  o K9970: Subscribing to email notifications regarding F5 products
  o K9957: Creating a custom RSS feed to view new and updated documents

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXz3Tn+NLKJtyKPYoAQhsuQ//ea0XZpwv1MBpwZeFkqaG4cXv8E1gnYU4
ZJfEl2jHpWmYivwWNnW+NkYN50B7GxbUzKWEZV9gChZN+xekmu+Vs1YrkzcOlIi6
E+k89X12j9gyK1zNsaRHDvH4yAy+MfIQ4c2xudz0qenjjmEgnjttT9UR4L1SLCe8
ddrkMQ9uaIw7rQ+0vsHvVG6xfpjulro1pbdv+es6rVcm5LKrjVMaS2SZw2LCpjuO
yjMiBoyc5pMyFfEahwC09pB6PINB/KAOArushjmFkgV6QqQFf6FJ9/d0VwMNqdDB
CwRgX3WUHNgXX9iVYnlLiv4FU+Inj28KsHjVx6FPEfboXMs1vIAa801aeOdl8xgW
hLF7LQvZWIkL2kDhI54zQvEWBaT93y/tkVHvzECFNPY3DRrZW1KNXV/NIE+7XZP2
MJ2WKThGu2QC026ceV1tlubi54x/yUBsIjUXHWwpSt1gLYhfzezderQFgbgoBsEd
CDN5FnSPwe216NdnLo+8JvBAu5ch3u8vxC8qdnQQhMrDw30ac6q/M4dgVgy6ZMtb
saEOjKZfSWjlwSyefm/5WhldcI3ImOUAXLMbo9JrrTlmaaxzkP0fazCXixpvcLEo
UyQRN2o1CwK6p7aDDRQGETs97g47JIgdp5OYZN9itqw/LMWbkoLj1vgggNdS8wt2
g/W333sSD/w=
=wJGV
-----END PGP SIGNATURE-----