CVE-2024-36940 Siemens CVE debrief

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those deploying SCALANCE XC/XR series switches or RUGGEDCOM RST2428P devices in critical infrastructure environments. System administrators responsible for maintaining firmware versions and security posture of OT/ICS networks should prioritize this update.

Technical summary

The vulnerability stems from improper resource management in the Linux kernel's pin control (pinctrl) subsystem. The `pctldev` structure is allocated as a device-managed resource using `devm_pinctrl_register_and_init()`, which registers a release callback (`devm_pinctrl_dev_release()`) to automatically free the structure when the device is unbound. However, `pinctrl_enable()` contained an explicit `kfree()` call on this same structure, resulting in a double-free when the device is later released. The `devm_pinctrl_dev_release()` function also handles freeing of `pindescs` and mutex destruction, meaning the erroneous free in `pinctrl_enable()` could occur while these dependent resources are still in use, potentially causing use-after-free conditions. The fix removes the incorrect free operation, allowing proper managed resource cleanup.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided firmware updates to version 3.1 or later for affected SCALANCE and RUGGEDCOM devices
• Review device inventory to identify systems running SINEC OS versions prior to 3.1
• Implement network segmentation for industrial control systems to limit local access
• Monitor for anomalous system behavior or unexpected reboots on affected devices
• Follow CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-25-226-15, which references Siemens ProductCERT advisory SSA-613116. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a local attack vector with low attack complexity, requiring low privileges and resulting in high availability impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.