PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26901 Siemens CVE debrief

A kernel information leak vulnerability exists in the Linux kernel's `do_sys_name_to_handle()` function. The issue stems from the use of `kmalloc()` without proper initialization, which can expose uninitialized kernel memory to user space. The vulnerability has been resolved by switching to `kzalloc()` to ensure zero-initialization of allocated memory. This vulnerability affects Siemens SIMATIC S7-1500 TM MFP industrial control systems that utilize the GNU/Linux subsystem. The CVSS 3.1 score of 5.3 (MEDIUM) reflects network accessibility with low attack complexity, requiring no privileges or user interaction, with availability impact as the primary concern. No known exploitation in the wild has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2023-12-12
Original CVE updated
2025-08-12
Advisory published
2023-12-12
Advisory updated
2025-08-12

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled should prioritize this vulnerability. System administrators responsible for OT/ICS environments, security teams managing industrial control system security postures, and compliance officers tracking CVE remediation for critical infrastructure assets should monitor this issue. The vulnerability is particularly relevant for environments where the GNU/Linux subsystem is exposed to network access or where untrusted code execution is possible.

Technical summary

The vulnerability exists in the Linux kernel function `do_sys_name_to_handle()`, which is used to obtain a file handle from a pathname. The original implementation used `kmalloc()` to allocate memory for the file handle structure without zero-initializing the allocated memory. This can result in kernel information leakage to user space, as uninitialized memory may contain sensitive kernel data. The fix replaces `kmalloc()` with `kzalloc()`, which zero-initializes the allocated memory, preventing information disclosure. The vulnerability is remotely exploitable with low complexity and requires no authentication, though the confidentiality impact is none per the CVSS scoring, with availability impact rated as low.

Defensive priority

medium

Recommended defensive actions

  • Limit access to the interactive shell of the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for Siemens security advisories for future patch availability
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-102-01, which references the Linux kernel fix for kernel-infoleak in `do_sys_name_to_handle()`. The affected product is explicitly identified as Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L is provided in the source advisory. The source advisory indicates no fix is currently available as of the last modification date (2026-05-14).

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26901 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26901

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26901 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26901

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.