CVE-2025-61935

Executive Summary

CVE-2025-61935 is a high-severity denial-of-service (DoS) vulnerability affecting F5 BIG-IP Advanced WAF and ASM modules. When a security policy is configured on a virtual server, undisclosed specially crafted requests can cause the bd process to terminate, leading to service disruption. The vulnerability has a CVSS score of 7.5, indicating significant availability impact. No public exploit code or proof-of-concept (PoC) is currently available, and no patch has been released by the vendor. The attack vector is network-based, requires no authentication, and no user interaction, making it remotely exploitable. The root cause is improper input validation (CWE-20) in the security policy processing engine.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (HIGH)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service availability.
• Threat Level: High – Remote, unauthenticated DoS with no patch available.

Deep Dive & Mechanics

The vulnerability resides in the bd process, which is the core traffic management daemon for BIG-IP. When a security policy (Advanced WAF or ASM) is applied to a virtual server, the bd process inspects incoming requests against the policy rules. An undisclosed sequence or malformation in the request triggers a memory corruption or logic error within the policy evaluation engine, causing the bd process to crash and restart. This results in a temporary denial of service for all traffic handled by that virtual server.

The exact mechanism is not publicly documented, but based on the CWE-20 classification, it likely involves improper validation of request parameters (e.g., headers, cookies, or payload) that are passed to the security policy engine. The crash is immediate and does not require a high volume of requests, making it a low-complexity attack.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is within the proprietary bd binary, which handles security policy enforcement. The fix would likely involve adding input sanitization or bounds checking in the policy evaluation logic. Without vendor disclosure, a code comparison is not possible.

Exploitation & Lab Setup

Red Team

No public exploit code exists. To simulate the vulnerability in a lab environment, an attacker would need to reverse-engineer the bd process or perform fuzzing against a BIG-IP system with an Advanced WAF or ASM policy enabled. The following steps outline a potential approach:

1. Setup: Deploy a BIG-IP virtual edition with a licensed Advanced WAF or ASM module.
2. Configure: Create a security policy (e.g., "Rapid Deployment Policy") and attach it to a virtual server.
3. Fuzz: Use a tool like wfuzz or custom Python scripts to send malformed HTTP requests (e.g., oversized headers, invalid Unicode, or deeply nested JSON) to the virtual server.
4. Monitor: Observe the bd process using tmsh show sys process or tail -f /var/log/ltm. A crash will manifest as a process restart and log entries like "bd process terminated unexpectedly."

# Example fuzzing script (conceptual)
import requests
import random

target = "https://<big-ip-vip>"
payload = "A" * 10000  # Oversized header value
headers = {"X-Custom": payload}
try:
    r = requests.get(target, headers=headers, verify=False, timeout=5)
except requests.exceptions.ConnectionError:
    print("Connection lost - possible DoS")

Blue Team

To detect and mitigate exploitation attempts:

1. Monitor bd Process: Set up alerts for unexpected restarts of the bd process.

   # On BIG-IP CLI
   tmsh show sys process | grep bd
   

2. Log Analysis: Review /var/log/ltm for crash indicators.

   grep -i "bd.*terminated" /var/log/ltm
   

3. Rate Limiting: Apply rate limiting on virtual servers to reduce attack surface.
4. WAF Bypass Detection: Look for requests with unusual payload sizes or patterns that bypass security policy checks.

Indicators of Compromise (IOCs)

• Process Crash: Repeated termination and restart of the bd process.
• Log Entries: Messages in /var/log/ltm containing "bd process terminated unexpectedly" or "core dump" references.
• Network Traffic: Unusually large or malformed HTTP requests targeting virtual servers with Advanced WAF/ASM policies.
• Service Disruption: Intermittent unavailability of applications behind the affected virtual server.

Detection Engineering

YARA Rule

rule CVE_2025_61935_bd_crash {
    meta:
        description = "Detects log entries indicating bd process crash from CVE-2025-61935"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61935"
    strings:
        $crash1 = "bd process terminated" ascii wide nocase
        $crash2 = "bd terminated unexpectedly" ascii wide nocase
        $crash3 = "core dump" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: F5 BIG-IP bd Process Crash
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects repeated bd process crashes indicative of CVE-2025-61935 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: f5
    service: ltm
detection:
    selection:
        EventID: 0
        Message|contains:
            - 'bd process terminated'
            - 'bd terminated unexpectedly'
    condition: selection
falsepositives:
    - Legitimate process restarts due to maintenance
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-61935 F5 BIG-IP bd DoS Attempt"; flow:to_server,established; content:"|0d 0a|"; http_header_names; pcre:"/^X-Custom:\s.{1000,}/Hmi"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: If possible, disable Advanced WAF or ASM security policies on virtual servers until a patch is available. If disabling is not feasible, implement strict rate limiting and request size restrictions.
• Short-term: Monitor F5's security advisory page for an official patch. Apply any workaround provided by the vendor.
• Long-term: Upgrade to a supported software version once the patch is released. Ensure all BIG-IP systems are within vendor support lifecycle.
• Compensating Controls: Use network-based IPS/IDS to filter malformed requests. Implement Web Application Firewall (WAF) rules at the network edge to block oversized or anomalous payloads.

Valters IT
DevSecOps & Cyber Threat Intelligence