PatchSiren cyber security CVE debrief

CVE-2024-35813 Siemens CVE debrief

A vulnerability in the Linux kernel's MMC (MultiMediaCard) core subsystem could allow a local attacker to cause a denial of service condition. The flaw exists in the close-ended FFU (Field Firmware Update) code path where an array access using `prev_idata = idatas[i - 1]` occurs without validating that the iterator `i` is greater than zero. This missing bounds check could result in a negative array index access. The vulnerability was introduced in commit 4d0c8d0aef63 (mmc: core: Use mrq.sbc in close-ended ffu). Siemens has identified this vulnerability as affecting the GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP industrial control system. No patch is currently available from the vendor.

Vendor: Siemens
Product: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP systems with the GNU/Linux subsystem enabled, industrial control system operators, OT security teams, and Linux kernel maintainers deploying MMC/SD card support in embedded or industrial environments.

Technical summary

The vulnerability is an off-by-one style bounds checking issue in the Linux kernel's MMC core subsystem. When processing close-ended FFU operations, the code assigns `prev_idata = idatas[i - 1]` without first verifying that `i > 0`. On the first iteration where `i == 0`, this results in accessing `idatas[-1]`, which is undefined behavior and typically causes an out-of-bounds memory access. This can lead to kernel crashes or memory corruption, resulting in denial of service. The fix involves adding a simple bounds check before the array access.

Defensive priority

medium

Recommended defensive actions

Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
Only build and run applications from trusted sources
Monitor for vendor security updates from Siemens
Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The vulnerability description is sourced from the Linux kernel commit message and CISA ICS advisory ICSA-24-102-01. The affected product identification comes from the CSAF product tree with high confidence. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with low attack complexity, low privileges required, and high availability impact.

Official resources

2024-04-09