PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-39469 Siemens CVE debrief

CVE-2024-39469 is a vulnerability in the Linux kernel's nilfs2 filesystem affecting Siemens industrial networking products. The flaw exists in the nilfs_empty_dir() function, which handles directory emptiness checks. When a directory folio/page read fails due to I/O errors, the function incorrectly continues looping instead of returning immediately. This can lead to two adverse outcomes: false determination that a directory is empty (potentially causing filesystem corruption), and extended I/O loops that may hang the log writer thread if directory inode size is also corrupted. The vulnerability was discovered through syzbot automated testing. Siemens has assessed the impact as misinformed for affected product configurations. The issue has been resolved in the Linux kernel by modifying nilfs_empty_dir() to return false (0) immediately upon folio/page read failure.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P and SCALANCE XC/XR/XCM/XRM/XCH families; OT security teams managing Linux-based industrial systems; kernel maintainers and distributors packaging nilfs2 support

Technical summary

The nilfs_empty_dir() function in Linux kernel nilfs2 filesystem contains defective error handling when directory folio/page reads fail. Rather than returning immediately on I/O error, the function continues iterating, which can: (1) falsely report directories as empty when nilfs_check_folio() fails, risking filesystem corruption; and (2) enter prolonged loops if directory i_size is corrupted, causing log writer thread hangs. The fix ensures immediate return of false (0) on any folio/page acquisition failure.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for specific product patch availability and version guidance
  • Verify kernel version on affected Siemens devices and apply vendor-provided updates when available
  • Monitor nilfs2 filesystem operations on affected systems for unexpected directory behavior or log writer thread hangs
  • Implement defense-in-depth controls per CISA ICS recommended practices for industrial control systems
  • Assess exposure of nilfs2-formatted storage in operational technology environments

Evidence notes

The vulnerability description is drawn from the CISA CSAF advisory ICSA-25-226-07, which republishes Siemens ProductCERT advisory SSA-355557. The nilfs2 filesystem is a log-structured filesystem for Linux. The syzbot reference indicates this was found through kernel fuzzing. Siemens threat assessment categorizes impact as misinformed for affected product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003.

Official resources

2025-08-12