PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42281 Siemens CVE debrief

This CVE addresses a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The issue occurs when downgrading the Generic Segmentation Offload (GSO) size, which can trigger a BUG_ON() assertion failure during subsequent skb (socket buffer) segmentation. The fix involves linearizing the skb when downgrading gso_size to prevent this crash condition. Siemens has identified this vulnerability as affecting the GNU/Linux subsystem within their SIMATIC S7-1500 TM MFP industrial control product. The vulnerability requires local access with high privileges to exploit, resulting in low integrity impact but high availability impact. No patch is currently available from Siemens; mitigation relies on restricting access to trusted personnel and ensuring only trusted applications are executed.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with enabled GNU/Linux subsystems; OT security teams managing embedded Linux environments in manufacturing and process control; system integrators deploying BPF-based networking or monitoring solutions on affected platforms.

Technical summary

The vulnerability exists in the Linux kernel's BPF subsystem when handling Generic Segmentation Offload (GSO) size downgrades. The socket buffer (skb) segmentation logic can trigger a BUG_ON() assertion when the gso_size is downgraded without proper linearization. The kernel fix linearizes the skb during this operation to prevent the crash. In the context of Siemens SIMATIC S7-1500 TM MFP, this affects the embedded GNU/Linux subsystem where BPF programs may be utilized. The attack vector is local, requiring high privileges, with no confidentiality impact, low integrity impact, and high availability impact per the CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem on affected Siemens SIMATIC S7-1500 TM MFP devices to trusted personnel only
  • Implement application whitelisting to ensure only trusted, verified applications are built and executed on the GNU/Linux subsystem
  • Monitor for an official security patch from Siemens and apply when available
  • Review network segmentation for affected industrial control systems to limit lateral movement potential
  • Apply defense-in-depth strategies per ICS-CERT recommended practices for industrial control systems

Evidence notes

CVE published 2024-04-09 per official CVE record. Modified 2026-05-14. Source advisory ICSA-24-102-01 published 2024-04-09. Siemens SSA-265688 referenced as primary vendor advisory. CVSS 5.1 (MEDIUM) per source. Not listed in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-42281 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-42281

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-42281 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-42281

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.