PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-27077 Siemens CVE debrief

CVE-2024-27077 is a HIGH severity memory leak vulnerability in the Linux kernel's Video4Linux2 (V4L2) memory-to-memory framework. The flaw exists in the `v4l2_m2m_register_entity` function where `entity->name` is allocated but not freed in error-handling paths, leading to memory exhaustion over time. This vulnerability was published on April 9, 2024, and affects Siemens SIMATIC S7-1500 TM MFP industrial control systems through their GNU/Linux subsystem. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, no privileges required, and high impacts to confidentiality, integrity, and availability. CISA and Siemens have issued coordinated advisories with mitigation guidance, though no patch is currently available.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Industrial control system operators, OT security teams, Siemens SIMATIC users, critical infrastructure defenders, and organizations running Linux-based embedded systems with V4L2 media components

Technical summary

The vulnerability resides in `v4l2_m2m_register_entity()` within the Linux kernel's `drivers/media/v4l2-core/v4l2-mem2mem.c`. The function allocates memory for `entity->name` via `kstrdup()` or similar allocation, but subsequent error paths fail to invoke `kfree()` on this allocation. This results in a memory leak that can be triggered during entity registration failures. In industrial control contexts like the Siemens SIMATIC S7-1500 TM MFP, sustained operation with error conditions could lead to memory exhaustion and system instability. The attack surface is reachable through the network-accessible GNU/Linux subsystem, though user interaction is required per the CVSS vector.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Build and run applications exclusively from trusted sources
  • Monitor for memory exhaustion indicators on affected systems
  • Apply vendor patches when released by Siemens
  • Implement network segmentation for affected industrial control systems

Evidence notes

Vulnerability description and affected product confirmed through CISA CSAF advisory ICSA-24-102-01 and Siemens SSA-265688. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H sourced from official advisory. Timeline based on CVE published date of 2024-04-09 and modified date of 2026-05-14 per official records.

Official resources

Coordinated disclosure via CISA ICS advisory and Siemens ProductCERT