PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-35967 Siemens CVE debrief

A vulnerability in the Linux kernel's Bluetooth SCO (Synchronous Connection Oriented) socket implementation allows local attackers to cause denial of service conditions. The flaw stems from insufficient validation of user-supplied input passed to the setsockopt system call for SCO sockets. A local attacker with low privileges can exploit this to trigger a denial of service condition on affected systems. The vulnerability has been assigned a CVSS 3.1 score of 5.5 (MEDIUM severity) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. This CVE was published on April 9, 2024, and was subsequently included in CISA's ICS advisory ICSA-24-102-01 for Siemens SIMATIC S7-1500 TM MFP industrial control systems, which incorporate a GNU/Linux subsystem affected by this kernel-level vulnerability.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-20
Original CVE updated
2026-08-04
Advisory published
2024-05-20
Advisory updated
2026-08-04

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled should prioritize assessment. System administrators responsible for industrial control system security, OT security teams, and organizations with Bluetooth-enabled industrial devices should evaluate exposure. The local attack vector requires attacker access to the target system, making this particularly relevant for multi-user industrial environments or systems with potential insider threats.

Technical summary

The vulnerability exists in the Bluetooth SCO (Synchronous Connection Oriented) socket implementation within the Linux kernel. Specifically, the setsockopt system call handler for SCO sockets fails to properly validate user-supplied input, allowing a local attacker with low privileges to trigger denial of service conditions. SCO sockets are used for synchronous voice/data transport over Bluetooth, commonly utilized in headset and audio applications. The lack of input validation in the setsockopt path can lead to kernel instability or crashes when malformed or out-of-range values are provided. This represents a classic input validation weakness (CWE-20) in a kernel networking subsystem.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem on affected Siemens SIMATIC S7-1500 TM MFP devices to trusted personnel only
  • Implement application whitelisting to ensure only trusted applications are built and executed on the GNU/Linux subsystem
  • Monitor for anomalous Bluetooth-related system calls or SCO socket activity on affected systems
  • Apply kernel updates from Siemens when available, as the advisory currently indicates no fix is available
  • Segment affected industrial control systems from untrusted networks to limit local attack vectors
  • Review and implement CISA's ICS recommended practices for defense-in-depth strategies

Evidence notes

The vulnerability description is sourced from the CVE record and CISA CSAF advisory ICSA-24-102-01. The affected product identification (Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem) is derived from the CSAF product tree with high confidence. CVSS scoring details are taken from the source advisory references. The vulnerability affects the Bluetooth SCO socket implementation in the Linux kernel, specifically the setsockopt handling.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-35967 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-35967

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-35967 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-35967

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.