PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36939 Siemens CVE debrief

A vulnerability in the Linux kernel's NFS (Network File System) implementation could allow a local attacker to trigger a denial of service condition. The issue stems from improper error handling in nfs_net_init(), where the return value of rpc_proc_register() was ignored. When rpc_proc_register() fails but nfs_net_init() succeeds, subsequent destruction of the network namespace causes nfs_net_exit() to call remove_proc_entry() on a non-existent proc directory, triggering a kernel warning and potential system instability. This vulnerability was discovered by syzkaller and affects systems with per-netns procfs exposure introduced in commit d47151b79e32. The flaw has existed since at least Linux 2.6.12-rc2 but became more visible with recent changes to NFS procfs handling.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

System administrators running Linux-based industrial control systems, particularly Siemens SIMATIC S7-1500 TM MFP deployments with the GNU/Linux subsystem enabled. Container platform operators using network namespaces for isolation. Security teams monitoring for kernel-level vulnerabilities that could destabilize critical infrastructure systems.

Technical summary

The vulnerability exists in fs/nfs/inode.c in the nfs_net_init() function. When rpc_proc_register() fails to create the /proc/net/sunrpc/nfs directory in a network namespace, the error was not propagated, allowing nfs_net_init() to return success. During network namespace destruction, nfs_net_exit() unconditionally calls rpc_proc_unregister(), which invokes remove_proc_entry() for a directory that was never created. This triggers a WARNING at fs/proc/generic.c:711. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. The vulnerability is rated MEDIUM severity with a score of 5.5.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the fix for CVE-2024-36939
  • For Siemens SIMATIC S7-1500 TM MFP systems, limit access to the interactive shell of the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources on affected systems
  • Monitor for kernel warnings related to remove_proc_entry in system logs as potential indicators of exploitation attempts
  • Review network namespace creation and destruction patterns in containerized or multi-tenant environments where this vulnerability could be triggered

Evidence notes

The vulnerability was reported by syzkaller during testing of immature netns destruction. The kernel warning manifests at fs/proc/generic.c:711 in remove_proc_entry(). The root cause is that rpc_proc_register() errors were historically ignored in init_nfs_fs(), and the conversion to per-netns procfs in commit d47151b79e32 exposed this deficiency. The fix properly propagates rpc_proc_register() errors in nfs_net_init() to prevent the imbalanced proc entry removal.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36939 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36939

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36939 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36939

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.