CVE-2022-21658 Siemens CVE debrief

Who should care

Siemens SIDIS Prime operators, OT administrators, system integrators, and security teams responsible for privileged or service-account-based deployments should prioritize this issue. The risk is highest where the product or related maintenance tasks run with elevated privileges or act on attacker-influenced directory paths.

Technical summary

The advisory describes a CWE-363 race condition in Rust’s std::fs::remove_dir_all that can be abused to follow symlinks during deletion. In practical terms, a local attacker with some level of access can manipulate timing so a privileged program removes files or directories it should not reach. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H, reflecting local attack requirements but potentially significant integrity and availability impact. For Siemens SIDIS Prime, the provided remediation is to update to V4.0.700 or later. The advisory also states that adding pre-checks before calling remove_dir_all does not eliminate the race condition.

Defensive priority

High

Recommended defensive actions

• Upgrade Siemens SIDIS Prime to V4.0.700 or later.
• Prioritize remediation on systems where SIDIS Prime runs with elevated privileges or handles attacker-controlled paths.
• Review workflows that delete directories and treat pre-delete path checks as insufficient protection against race conditions.
• Apply least-privilege service design so a successful local manipulation has limited impact.
• Restrict write access and symlink creation opportunities in directories processed by privileged maintenance tasks.
• Use the Siemens and CISA advisory references for product-specific deployment guidance and confirmation of the fixed release.

Evidence notes

The supplied corpus states that Rust’s std::fs::remove_dir_all is vulnerable to a race condition enabling symlink following, and that this can cause a privileged program to delete inaccessible files or directories. It also states that Rust 1.58.1 contains the upstream patch, while the Siemens advisory’s product remediation for SIDIS Prime is V4.0.700 or later. The advisory was published on 2025-04-08 and revised on 2025-05-06 for typos.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.