PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40945 Siemens CVE debrief

CVE-2024-40945 is a Linux kernel IOMMU vulnerability where iommu_sva_bind_device() could return NULL instead of an ERR_PTR error value, potentially causing kernel NULL pointer dereference in drivers that only check IS_ERR(). The issue is limited to kernels without CONFIG_IOMMU_SVA configured. Siemens has assessed this as 'Misinformed' impact for affected industrial networking products, indicating the vulnerability does not pose actual risk to these systems. The CVE was published 2025-08-12 and last modified 2026-02-25. No KEV listing or known ransomware campaign use.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Linux-based Siemens industrial networking equipment (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family) should verify this assessment does not affect their risk posture. OT security teams monitoring CISA ICS advisories and kernel maintainers tracking IOMMU SVA subsystem correctness should track this for completeness.

Technical summary

The Linux kernel function iommu_sva_bind_device() in the IOMMU subsystem incorrectly returns NULL in certain error conditions instead of an ERR_PTR error pointer. Drivers such as idxd and uacce check return values using IS_ERR() only, which would not catch NULL returns, potentially leading to NULL pointer dereference. However, the function only returns NULL when CONFIG_IOMMU_SVA is disabled, limiting practical exploitability. Siemens has assessed this vulnerability as 'Misinformed' impact for affected industrial networking products including RUGGEDCOM RST2428P and SCALANCE families, indicating no actual security risk to these systems.

Defensive priority

low

Recommended defensive actions

  • Verify kernel configuration on Linux-based Siemens devices to confirm CONFIG_IOMMU_SVA is enabled
  • Apply vendor-provided firmware updates when available per Siemens SSA-355557
  • Monitor CISA ICS advisories for additional guidance on affected industrial control systems
  • Implement network segmentation for industrial control systems per CISA recommended practices
  • Review defense-in-depth strategies for industrial control environments

Evidence notes

Siemens ProductCERT SSA-355557 via CISA CSAF advisory ICSA-25-226-07. Siemens threat assessment categorizes impact as 'Misinformed' for affected products. CVE description confirms issue only manifests when kernel not configured with CONFIG_IOMMU_SVA.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-40945 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-40945

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-40945 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40945

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.