CVE-2024-50001 Siemens CVE debrief

Who should care

Organizations operating Siemens industrial networking equipment with Mellanox mlx5-based network interfaces, particularly in memory-constrained or high-load environments. System administrators of Linux-based industrial control systems using mlx5 drivers. Security teams responsible for OT/ICS infrastructure availability and PCI function stability. Organizations running s390 systems with IOMMU-enabled PCI devices where rogue DMA detection triggers hardware error states.

Technical summary

The vulnerability exists in the net/mlx5 driver's multi-packet WQE transmit code path. When dma_map_single() fails due to memory pressure or IOMMU page table exhaustion, the error handling at the err_unmap label incorrectly calls dma_unmap_single() on an entry from the sq->fifo list. Since the current skb mapping failed, this unmap operation targets a previously established, unrelated DMA mapping. The sq->fifo list tracks active mappings for cleanup; removing an entry without corresponding unmap of the actual DMA mapping creates a resource leak and, more critically, invalidates a valid IOVA that may still be in use by hardware. When that IOVA is subsequently accessed, the IOMMU detects an unauthorized DMA operation. On IBM Z (s390) systems with s390_iommu, this results in the PCI function being placed in error state, requiring manual recovery. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with low attack complexity, low privileges required, and high availability impact.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided updates: Update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later
• For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult vendor guidance for specific affected configurations and apply appropriate updates
• Monitor systems with Mellanox mlx5-based networking for PCI function error states, particularly under memory pressure conditions
• Implement memory pressure monitoring and alerting on affected industrial control systems
• Apply defense-in-depth strategies for industrial control systems per CISA guidance
• Review IOMMU configuration and logging for early detection of rogue DMA access attempts

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The flaw affects the net/mlx5 driver in the Linux kernel. The issue manifests under memory pressure conditions when IOMMU page table allocation fails. On s390 systems, this can trigger PCI function error states due to IOMMU rogue access detection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.