PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50282 Linux CVE debrief

CVE-2024-50282 describes a missing size check in the `amdgpu_debugfs_gprwave_read()` function within the Linux kernel's AMDGPU DRM driver. The vulnerability could allow a buffer overflow when the size parameter exceeds 4KB. However, the CISA CSAF advisory ICSA-25-226-07 (republished 2026-02-25) explicitly marks this CVE as **Misinformed** for Siemens products, indicating the vulnerability does not actually affect the listed Siemens industrial control system products. The advisory was initially published 2025-08-12 and underwent multiple revisions, with the most recent update correcting product status and removing rejected CVEs. No CVSS score or severity is available in the source corpus.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Linux systems with AMD GPUs should verify kernel versions; organizations with Siemens industrial networking equipment can deprioritize this CVE per CISA guidance

Technical summary

The vulnerability exists in `amdgpu_debugfs_gprwave_read()` in the Linux kernel's AMDGPU DRM driver, where a missing size check could permit buffer overflow for reads exceeding 4KB. This is a debugfs interface issue affecting AMD GPU kernel drivers. The CISA advisory indicates this CVE was incorrectly associated with Siemens industrial products and should be considered non-applicable to the listed SCALANCE and RUGGEDCOM devices.

Defensive priority

low

Recommended defensive actions

  • Verify no Linux-based systems with AMD GPUs in ICS environment use the affected kernel version
  • Review Siemens SSA-355557 for authoritative product-specific guidance
  • Apply standard kernel update practices if AMDGPU driver is present in environment
  • Document this CVE as non-applicable for listed Siemens industrial products per CISA advisory

Evidence notes

The source advisory explicitly categorizes this CVE's impact as 'Misinformed' for the affected product IDs (CSAFPID-0006, CSAFPID-0002, CSAFPID-0003). The CVE description references a Linux kernel AMDGPU driver issue, which appears unrelated to the Siemens industrial networking products listed in the advisory. The 2026-02-25 republication updated the advisory based on Siemens ProductCERT SSA-355557.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50282 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50282

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50282 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50282

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.