CVE-2024-49884 Siemens CVE debrief

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 industrial networking equipment; critical infrastructure operators with SINEC OS deployments; industrial control system administrators responsible for maintaining availability of network infrastructure; security teams monitoring Linux kernel vulnerabilities in embedded/OT environments

Technical summary

CVE-2024-49884 is a slab-use-after-free vulnerability in the Linux kernel's ext4 filesystem implementation, specifically in the ext4_split_extent_at() function. This memory safety issue can lead to system instability or denial of service conditions. The vulnerability affects Siemens industrial networking products that incorporate the vulnerable Linux kernel version, including RUGGEDCOM RST2428P switches and select SCALANCE product families running SINEC OS. The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector requiring low privileges, with high availability impact but no confidentiality or integrity impact. Siemens has released updates to address this vulnerability, with specific version requirements varying by product family.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided updates: Update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later version per Siemens guidance
• For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update instructions
• Implement defense-in-depth strategies for industrial control systems as recommended by CISA
• Monitor for anomalous filesystem activity on affected systems prior to patching
• Restrict local access to affected systems to authorized personnel only

Evidence notes

The vulnerability description indicates a slab-use-after-free condition in ext4_split_extent_at() that was resolved in the Linux kernel. Siemens ProductCERT advisory SSA-355557 and CISA advisory ICSA-25-226-07 document affected products and remediation guidance. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector with low attack complexity, requiring low privileges, resulting in high availability impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.