PatchSiren cyber security CVE debrief

CVE-2023-2269 Siemens CVE debrief

A denial-of-service vulnerability exists in the Linux Kernel Device Mapper-Multipathing sub-component, specifically within the `table_clear` function in `drivers/md/dm-ioctl.c`. The issue stems from a possible recursive locking scenario that can result in a deadlock. This vulnerability affects Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) and TIM 1531 IRC (6GK7543-1MX00-0XE0) devices. The CVSS v3.1 score of 4.4 (MEDIUM) reflects local attack vector, low attack complexity, high privileges required, and high availability impact. CISA published advisory ICSA-24-165-06 on June 11, 2024, with a subsequent update on July 9, 2024. Siemens has released firmware version V2.4.8 or later to address this vulnerability.

Vendor: Siemens
Product: SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
CVSS: MEDIUM 4.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-02-13
Original CVE updated: 2024-02-13
Advisory published: 2024-02-13
Advisory updated: 2024-02-13

Who should care

Organizations operating Siemens TIM 1531 IRC industrial communication modules in critical infrastructure environments, including manufacturing, energy, and process control sectors. System administrators responsible for firmware lifecycle management in OT/ICS environments should prioritize this update.

Technical summary

The vulnerability resides in the `table_clear` function within `drivers/md/dm-ioctl.c` of the Linux Kernel Device Mapper-Multipathing sub-component. A recursive locking scenario can trigger a deadlock condition, resulting in denial of service. The attack requires local access and high privileges (PR:H), limiting exploitability. The vulnerability was addressed in Siemens firmware V2.4.8.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided firmware update to version V2.4.8 or later for affected Siemens TIM 1531 IRC devices
Verify current firmware version on SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) and TIM 1531 IRC (6GK7543-1MX00-0XE0) installations
Implement network segmentation for industrial control systems to limit exposure of affected devices
Follow CISA ICS recommended practices for defense-in-depth strategies
Monitor Siemens ProductCERT portal for additional security updates related to SSA-337522

Evidence notes

The vulnerability description and affected products are derived from CISA CSAF source ICSA-24-165-06. CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C confirms local attack vector with high privileges required. Remediation guidance specifies firmware update to V2.4.8 or later.

Official resources

CISA disclosed this vulnerability via ICS advisory ICSA-24-165-06 on June 11, 2024, with Siemens providing coordinated disclosure through their product security advisory SSA-337522.