CVE-2024-35978 Siemens CVE debrief

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled should prioritize this vulnerability. System administrators responsible for OT/ICS environments, security teams managing industrial control system security, and personnel with access to the interactive shell of affected devices should be aware of this issue. The vulnerability is particularly relevant for environments where multiple users or applications have access to the GNU/Linux subsystem.

Technical summary

The vulnerability exists in the Linux kernel's Bluetooth HCI (Host Controller Interface) implementation. The hci_req_sync_complete() function fails to properly release memory allocations under specific conditions, resulting in a memory leak. Over time, this can exhaust available system memory and cause denial of service conditions. The flaw is classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The attack requires local access with low privileges, making it most relevant in multi-user environments or where untrusted code execution is possible on the GNU/Linux subsystem of affected Siemens industrial controllers.

Defensive priority

medium

Recommended defensive actions

• Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only
• Only build and run applications from trusted sources
• Monitor system memory utilization for anomalous consumption patterns
• Apply vendor patches when Siemens releases an update for this vulnerability
• Implement network segmentation to limit exposure of affected industrial control systems

Evidence notes

The vulnerability description is sourced directly from the CISA CSAF advisory ICSA-24-102-01, which identifies this as a Bluetooth memory leak in hci_req_sync_complete(). The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with low attack complexity, low privileges required, no user interaction, and high availability impact. The affected product is specifically the GNU/Linux subsystem component of Siemens SIMATIC S7-1500 TM MFP industrial controllers. No fix is currently available per the source advisory.

Official resources