PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42094 Siemens CVE debrief

CVE-2024-42094 describes a potential stack overflow condition in the Linux kernel's net/iucv subsystem. The vulnerability stems from explicit allocation of cpumask variables on the stack when the kernel is compiled with CONFIG_CPUMASK_OFFSTACK=y. This configuration-dependent weakness could allow local attackers to trigger stack overflow conditions, potentially leading to denial of service or other undefined behavior. The vulnerability was originally published on 2025-08-12 and last modified on 2026-02-25. Siemens has assessed this CVE as 'Misinformed' for affected products, indicating the vulnerability does not actually impact the listed product configurations as initially reported. The CVSS score of 7.1 (HIGH) reflects the theoretical severity of stack overflow conditions in kernel space, though the practical impact on Siemens products appears limited based on their threat assessment.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Linux-based industrial control systems, particularly those using Siemens SCALANCE or RUGGEDCOM networking equipment. System administrators managing s390/z Systems environments where IUCV is utilized. Security teams responsible for kernel configuration management in high-availability industrial networks. Compliance officers tracking CVE coverage for OT/ICS environments.

Technical summary

The vulnerability exists in the Linux kernel's Inter-User Communication Vehicle (IUCV) networking subsystem, specifically in how cpumask variables are allocated. When CONFIG_CPUMASK_OFFSTACK=y is set during kernel compilation, cpumask variables that would normally be allocated dynamically are instead placed on the stack. For large CPU count systems, these cpumask structures can consume significant stack space, potentially causing stack overflow. IUCV is primarily used in IBM System z (s390) environments for high-speed communication between virtual machines. The explicit stack allocation bypasses the intended dynamic allocation mechanism, creating a local denial of service vector. Siemens has determined this vulnerability is 'Misinformed' for their affected product lines, suggesting either the vulnerable code path is not present, the configuration is not used, or the initial assessment was incorrect.

Defensive priority

medium

Recommended defensive actions

  • Verify kernel configuration on Linux-based systems to determine if CONFIG_CPUMASK_OFFSTACK=y is enabled
  • Apply vendor-provided kernel updates for affected Siemens industrial networking products when available
  • Monitor Siemens ProductCERT advisory SSA-355557 for updated product-specific guidance
  • Review CISA ICS recommended practices for defense-in-depth strategies for industrial control systems
  • Assess exposure of IUCV (Inter-User Communication Vehicle) interfaces in s390/z Systems environments where this subsystem is primarily used

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Siemens threat assessment categorizes impact as 'Misinformed' for affected products. Source advisory ICSA-25-226-07 underwent multiple revisions, with the 2026-02-25 update reflecting republication based on Siemens ProductCERT SSA-355557 advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-42094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-42094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-42094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-42094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.