PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50051 Siemens CVE debrief

This CVE describes a use-after-free (UAF) vulnerability in the Linux kernel's SPI driver for the Freescale/NXP MPC52xx platform. The issue occurs in the `mpc52xx_spi_remove` function when a kernel module is unloaded: the driver's private data structure (`ms`) is freed via `spi_unregister_controller`, but a pending work item (`ms->work`) may still be scheduled for execution, leading to memory corruption and potential system instability or privilege escalation. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.5, reflecting local attack vector, low attack complexity, and high availability impact. Siemens has identified affected products in its industrial networking portfolio, including RUGGEDCOM RST2428P and SCALANCE switch families running SINEC OS. The vendor has released updates to address this issue, with specific version guidance provided per product line.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 industrial Ethernet switches; OT security teams managing SINEC OS deployments; Linux kernel maintainers for embedded/powerpc platforms; industrial control system administrators responsible for patch management in critical infrastructure environments

Technical summary

The vulnerability exists in the `spi-mpc52xx.c` Linux kernel driver used by Siemens SINEC OS in certain industrial networking products. The race condition occurs during module removal: `mpc52xx_spi_remove()` calls `spi_unregister_controller()`, which frees the driver-private `mpc52xx_spi` structure (`ms`), but if `ms->work` was previously queued via the workqueue mechanism, the pending work item may execute after the memory has been freed. The fix adds `cancel_work_sync(&ms->work)` before the unregister call to ensure all pending work completes before structure deallocation. This is a classic teardown race condition in Linux kernel driver code. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector with high availability impact, consistent with kernel memory corruption leading to system crash or instability.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to affected Siemens RUGGEDCOM and SCALANCE products per product-specific guidance in Siemens ProductCERT advisory SSA-355557
  • For RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family, update to SINEC OS V3.2 or later
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration and patch guidance
  • Implement network segmentation for industrial control systems to limit local access vectors
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Monitor Siemens ProductCERT and CISA ICS advisories for additional updates or clarifications

Evidence notes

The vulnerability description is derived from the Linux kernel commit message and CISA CSAF advisory ICSA-25-226-07. The affected product list and remediation guidance are sourced from Siemens ProductCERT advisory SSA-355557 as republished by CISA. CVSS scoring details are provided in the CSAF document. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the source publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50051 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50051

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50051 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50051

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.