PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-43830 Siemens CVE debrief

A use-after-free vulnerability exists in the Linux kernel's LED trigger subsystem. The flaw occurs in the deactivation path where sysfs attributes are unregistered after the deactivate() callback is invoked. Since trigger-specific data is typically allocated by activate() and freed by deactivate(), this ordering creates a race window where sysfs attribute show/store functions may access freed memory. The vulnerability affects Siemens SIMATIC S7-1500 TM MFP industrial control systems running the GNU/Linux subsystem. The issue was resolved by reordering operations to unregister sysfs attributes before calling deactivate(), ensuring proper reverse-order cleanup relative to the activation path.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-17
Original CVE updated
2026-08-04
Advisory published
2024-08-17
Advisory updated
2026-08-04

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled, particularly those allowing interactive shell access or running custom applications that may interact with LED triggers. System administrators responsible for securing OT/ICS environments and maintaining defense-in-depth strategies should prioritize access controls until patches become available.

Technical summary

The vulnerability is a use-after-free (CWE-416) in the Linux kernel's LED trigger subsystem. The root cause is incorrect cleanup ordering: device_remove_groups() was called after deactivate(), allowing concurrent sysfs attribute access to freed trigger-data. The fix reorders operations to unregister sysfs attributes before deactivation, matching the reverse order of activation (activate() before device_add_groups()). This affects systems where LED triggers with custom sysfs attributes are used, including the GNU/Linux subsystem on Siemens SIMATIC S7-1500 TM MFP industrial controllers.

Defensive priority

medium

Recommended defensive actions

  • Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for updates from Siemens regarding patch availability for SSA-265688

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-102-01, which references Siemens security advisory SSA-265688. The affected product is explicitly identified as SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) indicates local attack vector with low attack complexity, requiring low privileges, with high availability impact. The advisory notes no fix is currently available as of the source publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-43830 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-43830

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-43830 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-43830

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.