Bug ID 1024241: Empty TLS records from client to BIG-IP results in SSL session termination

Last Modified: Oct 09, 2024

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2

Fixed In:
17.1.1, 16.1.4, 15.1.9

Opened: Jun 09, 2021

Severity: 2-Critical

Symptoms

After client completes TLS handshake with BIG-IP, when it sends an empty TLS record (zero-length cleartext), the client BIG-IP SSL connection is terminated.

Impact

SSL connection termination is seen in TLS clients.

Conditions

This is reported on i7800 which has Intel QAT crypto device The issue was not reported on Nitrox crypto based BIG-IP platforms. Issue is not seen when hardware crypto is disabled.

Workaround

Disable hardware crypto acceleration.

Fix Information

N/A

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips