CVE-2024-43871 Siemens CVE debrief

Who should care

Linux kernel maintainers and developers of kernel device drivers using per-CPU allocations; operators of industrial control systems using Siemens RUGGEDCOM and SCALANCE networking equipment; security teams responsible for OT/ICS infrastructure patch management; organizations running embedded Linux systems with long uptimes where memory leaks could cause availability issues

Technical summary

The vulnerability exists in the Linux kernel's device resource management (devres) subsystem. The devm_free_percpu() function, used by device drivers to free per-CPU memory allocated via devm_alloc_percpu(), incorrectly calls devres_destroy() rather than devres_release(). The devres_destroy() function removes the resource from the device's managed resource list without invoking the actual release callback, leaving the per-CPU memory allocated. In contrast, devres_release() properly executes the release callback to free the underlying memory. This implementation error causes a memory leak each time devm_free_percpu() is invoked, potentially leading to resource exhaustion and system instability over time. The fix replaces devres_destroy() with devres_release() to ensure proper memory deallocation.

Defensive priority

medium

Recommended defensive actions

• Verify Linux kernel version in use and apply vendor-provided patches if running affected kernel versions
• Review Siemens ProductCERT advisory SSA-355557 for definitive product impact assessment
• For Siemens RUGGEDCOM RST2428P and SCALANCE product families, confirm current firmware version against vendor security notifications
• Implement standard ICS security practices including network segmentation and access controls per CISA recommended practices
• Monitor for kernel memory exhaustion indicators in systems utilizing per-CPU allocations through devm_alloc_percpu()
• Contact Siemens ProductCERT for clarification if product-specific impact remains uncertain

Evidence notes

The CVE description states the vulnerability was resolved in the Linux kernel by replacing devres_destroy() with devres_release() in devm_free_percpu(). The CISA CSAF advisory ICSA-25-226-07 (published 2025-08-12, modified 2026-02-25) lists this CVE with threat category 'impact' marked as 'Misinformed' for product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003. Siemens ProductCERT advisory SSA-355557 is the authoritative source for product impact assessment. The CVSS score of 5.5 (MEDIUM) reflects availability impact through resource exhaustion. No known exploitation in the wild or ransomware campaign use has been reported.

Official resources