CVE-2020-5898: Medium severity f5 access policy manager vulnerability
In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \\.\urvpndrv device causing the Windows kernel to crash.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-5898?
CVE-2020-5898 is a vulnerability in the BIG-IP Edge Client Windows Stonewall driver that allows a local user to crash the Windows kernel by sending crafted DeviceIoControl requests.
Which versions of F5 Big-IP Access Policy Manager are affected by CVE-2020-5898?
Versions 11.6.1 to 11.6.5.1, 12.1.0 to 12.1.5.1, 13.1.0 to 13.1.3.3, 14.1.0 to 14.1.2.5, and 15.0.0 to 15.1.0.3 of F5 Big-IP Access Policy Manager are affected by CVE-2020-5898.
What is the severity of CVE-2020-5898?
CVE-2020-5898 has a severity rating of 5.5, which is considered medium.
How can I fix CVE-2020-5898?
To fix CVE-2020-5898, it is recommended to upgrade to a version of F5 Big-IP Access Policy Manager that is not affected by the vulnerability. More details can be found in the F5 advisory linked in the references.
Where can I find more information about CVE-2020-5898?
More information about CVE-2020-5898 can be found in the F5 advisory at the following link: [F5 Advisory CVE-2020-5898](https://support.f5.com/csp/article/K69154630)