CVE-2020-5898 : Security Advisory and Response

In versions 7.1.5-7.1.9 of F5 Edge Client, a vulnerability exists where the BIG-IP Edge Client Windows Stonewall driver fails to sanitize userland pointers. This flaw allows a local user to crash the Windows kernel by sending malicious DeviceIoControl requests.

Understanding CVE-2020-5898

This CVE identifies a Denial of Service (DOS) vulnerability in F5 Edge Client versions 7.1.5-7.1.9.

What is CVE-2020-5898?

The vulnerability in F5 Edge Client versions 7.1.5-7.1.9 allows a local user to trigger a Windows kernel crash by exploiting the lack of pointer sanitization in the Stonewall driver.

The Impact of CVE-2020-5898

Exploitation of this vulnerability can lead to a Denial of Service condition on the affected Windows client system, potentially disrupting normal operations.

Technical Details of CVE-2020-5898

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability arises from the failure of the Stonewall driver in F5 Edge Client to properly sanitize userland pointers, enabling a local user to crash the Windows kernel.

Affected Systems and Versions

Product: F5 Edge Client
Versions: 7.1.5-7.1.9

Exploitation Mechanism

A local user can exploit this vulnerability by sending crafted DeviceIoControl requests to the \.\urvpndrv device, triggering a crash in the Windows kernel.

Mitigation and Prevention

To address CVE-2020-5898 and enhance system security, follow these mitigation strategies:

Immediate Steps to Take

Apply vendor-supplied patches or updates promptly.
Restrict access to vulnerable systems to trusted users only.
Monitor and analyze system logs for any suspicious activities.

Long-Term Security Practices

Implement the principle of least privilege to limit user access rights.
Conduct regular security training for users to raise awareness of potential threats.
Employ intrusion detection/prevention systems to detect and block malicious activities.

Patching and Updates

Ensure that all systems running F5 Edge Client are updated with the latest patches provided by the vendor to mitigate the vulnerability effectively.