Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646also known as Foreshadow-NG)

Impact

BIG-IP

CVE-2018-3646 requires an attacker who is capable of providing and running binary code of their choosing on the BIG-IP platform. This raises a high bar for attackers attempting to target BIG-IP systems over a network and would require an additional, unpatched, user-space remote code execution vulnerability to exploit these new issues.

The only administrative roles on a BIG-IP system allowed to execute binary code or exploitable analogs, such as JavaScript, are the Administrator, Resource Administrator, Manager, and iRules Manager roles. The Administrator and Resource Administrator users already have nearly complete access to the system and all secrets on the system that are not protected by hardware based encryption. The Manager and iRules Manager roles do have more restricted access to the system, but have the ability to install new iRulesLX code. A malicious authorized Manager or iRules Manager can install malicious binary code to exploit these information leaks and gain more privileged access. F5 recommends limiting access to these roles to trusted employees.

F5 believes that BIG-IP virtual editions running as a guest on public or private cloud infrastructure are no more vulnerable than any other Linux based guest. The host hypervisor must be patched to mitigate these issues for the host and between guests.

F5 believes that the highest impact realistic attack for CVE-2018-3646 may occur in multi-tenancy vCMP configurations :

CVE-2018-3646 may allow an attacker in one administrative domain to collect privileged information from the host or guests owned by another administrative domain. Exploiting these attacks would be significantly more difficult to utilize on BIG-IP than a standard Linux based system due to BIG-IP memory and process scheduling architecture. CVE-2018-3646 might allow an attacker in one administrative domain to collect privileged information from the host or guests owned by another administrative domain as long as the attacker's guest is configured as a single-core guest. BIG-IP always maps both hyper-threads of a given core to any guest with the 'Cores Per Guest' configuration set to two or more, but single-core guests may execute on the same processor core as another single-core guest or host code. This threat may be mitigated by ensuring all guests are set to at least two 'Cores Per Guest'.

BIG-IQ

On a BIG-IQ system, an attacker needs shell access using the Advanced Shell ( bash ) or TMOS Shell ( tmsh ) to execute binary code. By default, only the root and admin users on a BIG-IQ system have shell access. Additionally, only users with the Administrator role can be granted shell access, and this step must be performed using the shell.

iWorkflow

On an iWorkflow system, an attacker needs shell access using bash or tmsh to execute binary code. By default, only the root user on an iWorkflow system has shell access. Additionally, only users with the Administrator role can be granted shell access, and this step must be performed using the shell.

Enterprise Manager

On an Enterprise Manager system, an attacker needs shell access using bash or tmsh to execute binary code. By default, only the root user on an Enterprise Manager system has shell access. Additionally, only users with the Administrator role can be granted shell access.

Traffix SDC

An unprivileged attacker can use this vulnerability to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks.

Detections

Analytics

F5 Networks BIG-IP : Virtual Machine Manager L1 Terminal Fault vulnerability (K31300402)

medium Nessus Plugin ID 125480

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.9 Oct 22, 2026, 12:02 AM Detection (corrected module name from AM to AAM; version now includes hotfix level in scan results. corrected version threshold, removing a false positive on a specific hotfix. corrected version ranges across several modules for more accurate detection) Logic Changes (restored a KB flag used by other scan checks. updated to current plugin format. restricts detection to systems with the Configuration utility component installed. restricts detection to affected hardware models. restricts detection to systems with affected components installed) Plugin Feed: 202610220002
Version 1.8 Feb 27, 2025, 7:30 AM CVSS metrics ("CVSSv3 score" set to 5.6) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N") CVSSv3 score source (changed from "manual" to none) Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202502270730
Version 1.7 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.6 Nov 2, 2023, 8:18 PM CVSSv2 score source (set to "CVE-2018-3646") Detection (updated detection logic) Plugin metadata Plugin Feed: 202311022018
Version 1.5 Nov 2, 2023, 6:19 PM CVSSv2 score source (set to "CVE-2018-3646") Detection (updated detection logic) Plugin metadata Plugin Feed: 202311021819