CVE-2024-50033 Siemens CVE debrief

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P and SCALANCE switch families; system administrators managing Linux-based systems with PPP/SLIP interfaces; OT/ICS security teams responsible for network infrastructure in critical manufacturing, energy, and transportation sectors; and security researchers tracking kernel-level networking vulnerabilities.

Technical summary

The vulnerability resides in the Serial Line Internet Protocol (SLIP) header compression implementation in the Linux kernel. The `slhc_remember()` function, used for Van Jacobson TCP/IP header compression in PPP/SLIP connections, performed inadequate packet validation. It checked only that the packet length was at least 20 bytes (the minimum combined size of IPv4 and TCP headers without options) but did not verify that the packet actually contained valid IPv4 and TCP headers at the expected offsets. This allowed maliciously crafted packets to pass the length check while lacking proper headers, causing the function to access uninitialized memory when attempting to parse non-existent header fields. The fix adds explicit validation to ensure the packet includes the IPv4 and TCP headers that are expected to be present, and refactors the code with dedicated `iph` and `th` pointers for improved clarity and safety.

Defensive priority

HIGH

Recommended defensive actions

• Apply vendor-provided firmware updates to V3.2 or later for affected Siemens RUGGEDCOM and SCALANCE products
• For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance
• Implement network segmentation to limit exposure of PPP/SLIP interfaces to untrusted networks
• Monitor for anomalous PPP/PPPoE traffic patterns that may indicate exploitation attempts
• Apply principle of least privilege to limit local access to PPP/SLIP network interfaces
• Review and apply CISA ICS recommended practices for defense-in-depth strategies
• Consider disabling SLIP/PPP header compression if not required for operational functionality

Evidence notes

The vulnerability was discovered through syzbot fuzzing with KMSAN (Kernel Memory Sanitizer), which detected uninitialized memory usage in `slhc_remember()` at line 666 of `drivers/net/slip/slhc.c`. The call chain involved PPP/PPPoE processing: `pppoe_rcv_core` → `ppp_input` → `ppp_do_recv` → `ppp_receive_frame` → `ppp_receive_nonmp_frame` → `slhc_remember`. The root cause was that `slhc_remember()` only checked `len >= 20` without verifying the actual presence of valid IPv4 and TCP headers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.