PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-33847 Linux CVE debrief

A vulnerability in the F2FS (Flash-Friendly File System) compression implementation affects the GNU/Linux subsystem of Siemens SIMATIC S7-1500 TM MFP industrial controllers. The flaw occurs during partial truncation of compressed inodes, where valid block counts may change without corresponding updates to .i_blocks and .total_valid_block_count metadata fields, leading to potential filesystem corruption. This is a local attack vector requiring user interaction, with no confidentiality or integrity impact but high availability impact. The vulnerability was disclosed in April 2024 and remains unpatched as of the source document's last update in May 2026.

Vendor
Linux
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Industrial control system operators, OT security teams, and asset owners deploying Siemens SIMATIC S7-1500 TM MFP with enabled GNU/Linux subsystem functionality

Technical summary

The vulnerability exists in the F2FS filesystem compression code path. When a compressed inode undergoes partial truncation, the implementation assumes reserved blocks are present. However, the valid block count may change without proper synchronization of the .i_blocks and .total_valid_block_count fields, resulting in metadata inconsistency and potential filesystem image corruption. This affects the GNU/Linux subsystem running on Siemens SIMATIC S7-1500 TM MFP programmable logic controllers.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Only build and execute applications from trusted sources
  • Monitor for anomalous filesystem behavior or corruption indicators on affected devices
  • Apply vendor patches when released by Siemens
  • Implement defense-in-depth strategies per CISA ICS recommended practices

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-102-01, which references Siemens security advisory SSA-265688. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, no privileges required, user interaction required, with high availability impact. The source document explicitly states 'Currently no fix is available' as of its last revision.

Official resources

public