PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42272 Siemens CVE debrief

CVE-2024-42272 is a medium-severity vulnerability (CVSS 5.5) affecting the Linux kernel's traffic control subsystem, specifically in the `act_ct` (connection tracking action) scheduler. The issue involves improper handling of padding in the `struct zones_ht_key` structure, which can lead to memory safety issues. This vulnerability was published on April 9, 2024, and affects Siemens SIMATIC S7-1500 TM MFP industrial control systems through their GNU/Linux subsystem. The vulnerability requires local access with low privileges to exploit, and successful exploitation results in high availability impact (denial of service) with no confidentiality or integrity impact. No known ransomware campaigns have been associated with this vulnerability, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Industrial control system operators, OT security teams, Siemens SIMATIC S7-1500 TM MFP administrators, critical infrastructure security personnel, and organizations running embedded Linux subsystems in PLC environments should prioritize this vulnerability for monitoring and access control mitigation.

Technical summary

The vulnerability exists in the Linux kernel's `act_ct` (connection tracking action) scheduler component, which is part of the traffic control (tc) subsystem. The `struct zones_ht_key` structure contains padding bytes that are not properly initialized or compared, potentially leading to hash table lookup failures or memory corruption. This affects the GNU/Linux subsystem embedded in Siemens SIMATIC S7-1500 TM MFP programmable logic controllers. The vulnerability is exploitable locally by an attacker with low privileges, and can result in denial of service conditions. No patch is currently available per vendor disclosure.

Defensive priority

medium

Recommended defensive actions

  • Limit access to the interactive shell of the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for vendor security updates from Siemens for patch availability
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance
  • Review network segmentation to limit exposure of affected systems

Evidence notes

The vulnerability description indicates a kernel-level memory structure issue in the Linux networking stack's connection tracking action. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms local attack vector with low attack complexity and low privileges required, resulting in high availability impact. The source advisory (ICSA-24-102-01) from CISA provides official vendor acknowledgment through Siemens.

Official resources

public