PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-46673 Siemens CVE debrief

CVE-2024-46673 is a double-free vulnerability in the Linux kernel's aacraid SCSI driver that was published on August 12, 2025, and last modified on February 25, 2026. The flaw occurs in the aac_probe_one() function, which calls hardware-specific initialization functions through the aac_driver_ident::init pointer. These functions eventually invoke aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but fails to clear the pointer member. When the hardware-specific init function returns an error, aac_probe_one() follows an error path that attempts to free the memory pointed to by aac_dev::queues again, resulting in a double-free condition. This vulnerability is classified under CWE-415 (Double Free). The source advisory from CISA (ICSA-25-226-07) indicates that Siemens has assessed the impact as 'Misinformed' for affected products including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no CVSS score or severity rating is available in the provided source data. The advisory references Siemens ProductCERT advisory SSA-355557 for additional technical details and remediation guidance.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

System administrators managing Siemens RUGGEDCOM and SCALANCE industrial networking equipment, security teams responsible for industrial control system (ICS) infrastructure, and organizations running Linux-based embedded systems with Adaptec RAID controllers should prioritize understanding this vulnerability. The 'Misinformed' impact assessment from Siemens suggests the actual risk to specific product configurations may differ from the generic CVE description, making vendor-specific guidance essential.

Technical summary

The vulnerability exists in the aacraid SCSI driver probe path. When aac_init_adapter() fails after allocating aac_dev::queues, it frees the memory but leaves the pointer uncleared. The subsequent error handling in aac_probe_one() then attempts to free the same memory again, causing a double-free. This is a classic use-after-free pattern that can lead to memory corruption, potential denial of service, or in some cases code execution. The vulnerability affects the kernel driver initialization path, requiring local or physical access to trigger during device probe operations.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for detailed product-specific guidance
  • Verify kernel version and aacraid driver status on affected Siemens devices
  • Apply vendor-provided firmware updates when available
  • Monitor CISA ICS advisories for additional guidance
  • Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The threat assessment indicates 'Misinformed' impact for affected products. No CVSS score or severity is provided in the source data. The CVE is not listed in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-46673 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-46673

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-46673 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-46673

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.