PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41090 Siemens CVE debrief

CVE-2024-41090 is a HIGH severity vulnerability (CVSS 7.1) in the Linux kernel's tap driver, specifically in the `tap_get_user_xdp()` path. The flaw involves missing validation of frame length, which can result in corrupted socket buffers (skb) being passed down the network stack. This may lead to out-of-bounds memory access or inconsistent header metadata that confuses lower network layers. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has identified this CVE as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The issue stems from insufficient input validation (CWE-20) where `skb_set_network_header()` assumes frame size exceeds `ETH_HLEN` without proper verification.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

System administrators managing Siemens industrial networking equipment including SCALANCE switches and RUGGEDCOM devices; security teams responsible for OT/ICS network infrastructure; Linux kernel maintainers and network stack developers; organizations utilizing XDP-based networking solutions in industrial environments; CISOs and risk managers overseeing industrial control system security postures

Technical summary

The vulnerability exists in the Linux kernel's tap network driver, specifically within the `tap_get_user_xdp()` function used for XDP (eXpress Data Path) frame processing. The code fails to validate that incoming frames meet minimum length requirements before calling `skb_set_network_header()`, which assumes a frame size greater than `ETH_HLEN` (14 bytes). This missing validation allows malformed short frames to propagate through the network stack as corrupted socket buffers. The corrupted skb can trigger out-of-bounds memory accesses when downstream components attempt to parse network headers beyond the actual frame boundary, or cause protocol confusion due to inconsistent header length metadata. The flaw represents a classic input validation failure (CWE-20) in kernel networking code with potential for memory safety violations and network stack instability.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor-provided firmware updates for affected Siemens SCALANCE and RUGGEDCOM devices when available
  • Monitor Siemens ProductCERT advisory SSA-355557 for patch availability and updated affected product lists
  • Implement network segmentation to limit exposure of industrial control system devices
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies
  • Validate minimum frame size requirements in network configurations using tap interfaces
  • Consider disabling XDP (eXpress Data Path) functionality on affected systems if not required for operations

Evidence notes

The vulnerability description is sourced from CISA ICS Advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The CVSS score of 7.1 with HIGH severity is confirmed in the source material. The affected product list includes RUGGEDCOM RST2428P (6GK6242-6PA00) and SCALANCE networking equipment families. The root cause is identified as missing frame length validation in the tap driver's XDP (eXpress Data Path) processing code path.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-41090 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-41090

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-41090 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41090

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.