PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42272 Siemens CVE debrief

CVE-2024-42272 is a medium-severity vulnerability (CVSS 5.5) affecting the Linux kernel's traffic control subsystem, specifically in the `act_ct` (connection tracking action) scheduler. The issue involves improper handling of padding in the `struct zones_ht_key` structure, which can lead to memory safety issues. This vulnerability was published on April 9, 2024, and affects Siemens SIMATIC S7-1500 TM MFP industrial control systems through their GNU/Linux subsystem. The vulnerability requires local access with low privileges to exploit, and successful exploitation results in high availability impact (denial of service) with no confidentiality or integrity impact. No known ransomware campaigns have been associated with this vulnerability, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-17
Original CVE updated
2026-08-04
Advisory published
2024-08-17
Advisory updated
2026-08-04

Who should care

Industrial control system operators, OT security teams, Siemens SIMATIC S7-1500 TM MFP administrators, critical infrastructure security personnel, and organizations running embedded Linux subsystems in PLC environments should prioritize this vulnerability for monitoring and access control mitigation.

Technical summary

The vulnerability exists in the Linux kernel's `act_ct` (connection tracking action) scheduler component, which is part of the traffic control (tc) subsystem. The `struct zones_ht_key` structure contains padding bytes that are not properly initialized or compared, potentially leading to hash table lookup failures or memory corruption. This affects the GNU/Linux subsystem embedded in Siemens SIMATIC S7-1500 TM MFP programmable logic controllers. The vulnerability is exploitable locally by an attacker with low privileges, and can result in denial of service conditions. No patch is currently available per vendor disclosure.

Defensive priority

medium

Recommended defensive actions

  • Limit access to the interactive shell of the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for vendor security updates from Siemens for patch availability
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance
  • Review network segmentation to limit exposure of affected systems

Evidence notes

The vulnerability description indicates a kernel-level memory structure issue in the Linux networking stack's connection tracking action. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms local attack vector with low attack complexity and low privileges required, resulting in high availability impact. The source advisory (ICSA-24-102-01) from CISA provides official vendor acknowledgment through Siemens.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-42272 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-42272

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-42272 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-42272

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.