PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-35815 Siemens CVE debrief

A vulnerability in the Linux kernel's asynchronous I/O (AIO) subsystem could allow a local attacker to cause a denial of service condition. The flaw exists in the fs/aio code where kiocb_set_cancel_fn() may receive a struct kiocb pointer that is not embedded within struct aio_kiocb. Due to compiler-dependent behavior, the req->ki_ctx read could occur before the IOCB_AIO_RW flag check, potentially leading to unsafe memory access. The vulnerability was resolved by reordering the code to ensure the IOCB_AIO_RW test always precedes the ki_ctx read. This issue affects Siemens SIMATIC S7-1500 TM MFP industrial control systems that utilize the GNU/Linux subsystem.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled. System administrators responsible for OT/ICS security posture. Security teams monitoring Linux kernel vulnerabilities in embedded industrial environments.

Technical summary

The vulnerability stems from undefined compiler behavior in the Linux kernel's asynchronous I/O implementation. The function kiocb_set_cancel_fn() in fs/aio.c performs a type conversion from struct kiocb to struct aio_kiocb without first verifying that the kiocb is actually embedded within an aio_kiocb structure. The IOCB_AIO_RW flag check, which would prevent this unsafe conversion, may be reordered by the compiler to occur after the req->ki_ctx member access. This creates a window where invalid memory could be dereferenced. The fix restructures the code to enforce the correct evaluation order regardless of compiler optimization. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with low complexity, requiring low privileges, with high availability impact but no confidentiality or integrity impact.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for vendor security updates from Siemens for patch availability
  • Apply defense-in-depth strategies for industrial control system environments per CISA guidance

Evidence notes

The vulnerability description indicates this is a compiler-dependent code ordering issue in the Linux kernel AIO subsystem. The fix ensures proper validation sequence by checking IOCB_AIO_RW before accessing ki_ctx. Siemens has confirmed this affects the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP devices. No fix is currently available per vendor advisory.

Official resources

2024-04-09