PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-39484 Siemens CVE debrief

A resource leak vulnerability exists in the Linux kernel's Davinci MMC driver. When the driver is built-in (CONFIG_MMC_DAVINCI=y) rather than as a module, the remove function is marked with __exit and discarded at link time. If the device is unbound via sysfs or hotplug events, the driver is removed without executing cleanup code, leading to resource leaks. Siemens has assessed this vulnerability as 'Misinformed' for affected products, indicating the reported impact does not apply to their specific configurations.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Siemens industrial networking equipment including RUGGEDCOM RST2428P and SCALANCE X-family switches with SINEC OS, as well as any Linux systems using the Davinci MMC driver in built-in configuration

Technical summary

The Davinci MMC driver in the Linux kernel uses the __exit attribute on its remove function. When CONFIG_MMC_DAVINCI=y (built-in), this causes the linker to discard the remove callback. Device unbinding operations (sysfs unbind or hotplug removal) then proceed without executing cleanup code, resulting in resource leaks. The vulnerability is a coding pattern issue affecting kernel driver lifecycle management. Siemens products incorporating this component have been assessed with 'Misinformed' impact status per their security advisory.

Defensive priority

low

Recommended defensive actions

  • Verify kernel configuration for affected Siemens devices to confirm CONFIG_MMC_DAVINCI is not set to built-in (y) if the Davinci MMC driver is used
  • Review Siemens ProductCERT advisory SSA-355557 for specific product impact assessments
  • Apply vendor-provided firmware updates when available per Siemens security advisory guidance
  • Monitor CISA ICS advisories for updates to ICSA-25-226-07

Evidence notes

The vulnerability description indicates a kernel driver coding issue where __exit attribute causes the remove callback to be discarded for built-in drivers. Siemens ProductCERT advisory SSA-355557 and CISA ICSA-25-226-07 both document this assessment. The threat category in the source CSAF data is explicitly marked as 'Misinformed' for affected product IDs.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-39484 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-39484

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-39484 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-39484

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.