PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41049 Siemens CVE debrief

CVE-2024-41049 is a Linux kernel use-after-free in filelock/posix_lock_inode. In Siemens advisory ICSA-25-072-03 for SIMATIC S7-1500 TM MFP - BIOS, the issue is described as a race in which a lock entry can be freed before the tracepoint fires; the documented fix is to move the tracepoint inside the spinlock. At publication, Siemens listed no fix and only a trusted-source workaround.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - BIOS
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Operators and maintainers of Siemens SIMATIC S7-1500 TM MFP - BIOS systems, OT/embedded Linux administrators, and security teams responsible for controlling local code execution on affected devices.

Technical summary

The supplied source describes a Linux kernel bug in posix_lock_inode where a request pointer is changed to reference a lock entry on the inode list, but another task can race in and free that lock before trace_posix_lock_inode() runs, triggering a KASAN UAF warning. Siemens’ advisory ties this CVE to SIMATIC S7-1500 TM MFP - BIOS and gives CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). The stated remediation is to move the tracepoint inside the spinlock, and the advisory notes that no fix was available at publication.

Defensive priority

High

Recommended defensive actions

  • Review the Siemens CSAF advisory and associated product guidance for SIMATIC S7-1500 TM MFP - BIOS.
  • Apply the vendor-documented workaround: only build and run applications from trusted sources.
  • Limit local access and reduce opportunities for untrusted code execution on affected systems.
  • Track Siemens and upstream Linux kernel advisories for a vendor fix and deploy it promptly when available.
  • Follow CISA ICS recommended practices and defense-in-depth guidance for OT environments.

Evidence notes

Primary evidence comes from the CISA CSAF source item (ICSA-25-072-03), published 2025-03-11 and modified 2025-09-09, which includes the Linux kernel UAF description, the Siemens product association, the CVSS vector, and the remediation status. Siemens’ linked CSAF/HTML advisory references the same issue and the same remediation language. The later 2025-09-09 modification in the source history should not be treated as the CVE issue date; the disclosure date is 2025-03-11.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-41049 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-41049

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-41049 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41049

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-503939.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-503939.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.