CVE-2024-35922 Siemens CVE debrief

Who should care

Industrial control system operators, OT security engineers, and asset owners using Siemens SIMATIC S7-1500 TM MFP controllers with the GNU/Linux subsystem. Organizations in manufacturing, process control, and critical infrastructure sectors should prioritize access restrictions until a patch is released.

Technical summary

The vulnerability exists in the fb_videomode_from_videomode() function within the Linux kernel's framebuffer monitor (fbmon) code. A division-by-zero condition can occur when processing video mode timing parameters, resulting in a kernel crash and local denial-of-service. The attack requires local access with low privileges and no user interaction. The flaw does not enable privilege escalation, information disclosure, or code execution. Affected systems are Siemens SIMATIC S7-1500 TM MFP programmable logic controllers with the optional GNU/Linux subsystem enabled. No vendor patch is currently available; mitigation relies on access controls and trusted application execution.

Defensive priority

medium

Recommended defensive actions

• Restrict interactive shell access to the GNU/Linux subsystem to authorized personnel only
• Implement application whitelisting to ensure only trusted applications execute on affected systems
• Monitor for anomalous framebuffer or video subsystem activity in system logs
• Apply vendor patches when released by Siemens ProductCERT
• Review and implement CISA ICS recommended practices for defense-in-depth
• Segment industrial control networks to limit lateral movement potential

Evidence notes

The vulnerability description is sourced directly from the CISA CSAF advisory ICSA-24-102-01, which references Siemens SSA-265688. The affected product is explicitly identified as the GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP. The CVSS vector confirms local attack requirements and denial-of-service impact only. No fix availability is stated in the remediation section of the source advisory.

Official resources