CVE-2022-42328 Siemens CVE debrief

Who should care

Organizations operating Siemens SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, and SIPLUS ET 200SP CP industrial communication modules in virtualized Xen environments should prioritize this update. System administrators managing industrial control systems with guest VMs, security teams responsible for OT/ICS infrastructure, and organizations subject to NERC CIP or other industrial cybersecurity regulations should assess exposure and apply patches according to their change management procedures.

Technical summary

CVE-2022-42328 is a deadlock vulnerability in the Linux netback (xen-netback) driver that affects virtualized environments using Xen. The vulnerability was inadvertently introduced by the security patch for XSA-392, creating a race condition when freeing socket buffers (SKBs) of packets dropped during XSA-392 handling. A malicious or compromised guest virtual machine can trigger this deadlock, resulting in a denial-of-service condition. The vulnerability has a CVSS 3.1 score of 5.5 (MEDIUM) with a local attack vector, low attack complexity, and low privilege requirements. The primary impact is to availability (HIGH). Siemens has identified multiple SIMATIC and SIPLUS industrial communication processors as affected products, with firmware version 2.3 or later providing remediation.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided firmware updates to version 2.3 or later for affected Siemens SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, and SIPLUS ET 200SP CP products
• Review and implement CISA ICS recommended practices for defense-in-depth strategies in industrial control system environments
• Monitor for anomalous behavior in virtualized guest environments that may indicate exploitation attempts
• Consider network segmentation to limit exposure of vulnerable industrial control systems
• Evaluate the need for temporary workarounds if patches cannot be immediately applied, following organizational change management procedures

Evidence notes

The vulnerability description indicates this is a deadlock condition in the Linux netback driver introduced by a previous security patch (XSA-392). The source material from CISA CSAF advisory ICSA-24-165-10 identifies affected Siemens industrial control products. The CVSS vector indicates local attack vector with low attack complexity, requiring low privileges but no user interaction. The vulnerability results in high availability impact.

Official resources