PatchSiren cyber security CVE debrief

CVE-2024-27395 Siemens CVE debrief

A Use-After-Free vulnerability exists in the Linux kernel's Open vSwitch (ovs) connection tracking (ct) exit path. The flaw occurs in `ovs_ct_limit_exit` where `hlist_for_each_entry_rcu` is used to traverse a hash list, but `kfree_rcu` is called outside the RCU read critical section. This timing gap allows the RCU grace period to pass during traversal, potentially freeing the key before the loop completes. The fix changes the traversal to `hlist_for_each_entry_safe` to prevent premature deallocation. Siemens SINEC OS and related industrial network devices incorporate affected kernel components.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations running Siemens SINEC OS on SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family, or RUGGEDCOM RST2428P devices; Linux system administrators using Open vSwitch with connection tracking; industrial network operators relying on Open vSwitch for software-defined networking in operational technology environments.

Technical summary

The vulnerability stems from improper RCU synchronization in the Open vSwitch connection tracking limit cleanup routine. The `ovs_ct_limit_exit` function uses `hlist_for_each_entry_rcu` for hash list traversal, but the `kfree_rcu` call that frees entries is not protected within the same RCU read-side critical section. This creates a race condition where the RCU grace period may elapse between traversal and deallocation, resulting in use-after-free access to freed memory. The resolution replaces the RCU-safe traversal with `hlist_for_each_entry_safe`, which permits safe removal during iteration without relying on RCU grace period guarantees.

Defensive priority

HIGH

Recommended defensive actions

Apply vendor fix: Update Siemens SINEC OS to V3.1 or later version
Review network segmentation for affected SCALANCE and RUGGEDCOM devices
Monitor for anomalous local process behavior on affected systems
Follow CISA ICS recommended practices for defense in depth
Verify kernel patch status for non-Siemens Linux deployments using Open vSwitch

Evidence notes

CVE published 2025-08-12 per CISA CSAF advisory ICSA-25-226-15. Advisory modified 2026-02-25 with republication based on Siemens ProductCERT SSA-613116. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector with low complexity, low privileges required, and high impact across confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

CVE-2024-27395 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-27395

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-27395 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-27395

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.