PatchSiren cyber security CVE debrief

CVE-2024-49936 Siemens CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's Xen netback driver (net/xen-netback). The flaw occurs in the xenvif_flush_hash() function during list_for_each_entry_rcu iteration, where kfree_rcu is not properly protected within the RCU read critical section. If kfree_rcu is invoked when the RCU grace period ends during iteration, accessing head->next after the entry becomes free results in UAF. This vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE switch families. The vulnerability has a CVSS 3.1 score of 5.5 (MEDIUM severity) with local attack vector, low attack complexity, and low privileges required, with high availability impact.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 family switches in industrial environments. System administrators responsible for OT network security and availability. Security teams monitoring Linux kernel vulnerabilities affecting embedded industrial systems.

Technical summary

The vulnerability stems from improper RCU (Read-Copy-Update) synchronization in the xenvif_flush_hash() function of the Xen netback driver. During list_for_each_entry_rcu iteration, the kfree_rcu operation is not contained within the RCU read critical section. This timing window allows the RCU grace period to complete while iteration is ongoing, resulting in use-after-free when subsequent access to head->next occurs on freed memory. The flaw is classified under CWE-416 (Use After Free). Affected Siemens products incorporate this vulnerable kernel component in their SINEC OS firmware. Successful exploitation could cause denial of service conditions in network infrastructure devices.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided firmware updates to V3.2 or later for affected Siemens RUGGEDCOM and SCALANCE products
Review Siemens ProductCERT advisory SSA-355557 for specific product configuration guidance
Implement network segmentation for industrial control systems per CISA recommended practices
Monitor for anomalous behavior in affected network infrastructure devices
Validate that RCU-protected data structures in custom kernel modules follow proper critical section boundaries

Evidence notes

CVE published 2025-08-12 per official CVE record. CISA ICS advisory ICSA-25-226-07 published same date. Advisory modified 2026-02-25 with republication based on Siemens ProductCERT SSA-355557. Vendor fix requires update to V3.2 or later for affected products.

Sources and references

Verified primary and authoritative sources

CVE-2024-49936 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-49936

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-49936 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49936

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.