PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-38633 Siemens CVE debrief

A logic error in the Linux kernel's MAX3100 serial driver causes a NULL pointer dereference and kernel oops when the driver is reloaded after removal. The global variable tracking UART driver registration state is not updated on driver removal, causing subsequent probe attempts to reference invalid memory. Siemens SINEC OS-based products including RUGGEDCOM RST2428P and SCALANCE X-family switches are affected.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
NONE
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS, as well as any systems utilizing the Linux MAX3100 serial driver in kernel versions prior to the fix.

Technical summary

The MAX3100 SPI UART driver in the Linux kernel fails to update its global uart_driver_registered state variable upon driver removal. When the last MAX3100 device is removed, the driver unregisters but leaves the variable set. On subsequent driver reload (insmod), the probe function detects the stale state and skips UART driver registration, yet proceeds to register ports. This causes a NULL pointer dereference in serial_core_register_port when accessing the uninitialized uart_driver structure. The vulnerability also affects error paths in probe where premature variable assignment could leave inconsistent state. The resolution moves the uart_driver_registered assignment to occur only after successful uart_register_driver() completion, ensuring state consistency across driver lifecycle events.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor fix: Update affected Siemens SINEC OS products to V3.1 or later version
  • Review kernel driver state management in custom MAX3100 implementations
  • Monitor for kernel oops messages related to serial_core_register_port or max3100_probe
  • Implement defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

The vulnerability exists in the max3100 driver where uart_driver_registered is not cleared when the last device is removed. After an insmod-rmmod-insmod cycle, the probe function attempts to use stale state, triggering a NULL pointer dereference at serial_core_register_port+0xa0. The fix moves the variable assignment to occur only after successful uart_register_driver() completion.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-38633 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-38633

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-38633 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-38633

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.