PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-56645 Siemens CVE debrief

A reference count underflow vulnerability exists in the Linux kernel's J1939 Controller Area Network (CAN) protocol implementation. The flaw occurs in j1939_session_new() where improper socket buffer (skb) reference counting can lead to a use-after-free condition. Siemens has confirmed this vulnerability affects multiple industrial networking products running SINEC OS, including RUGGEDCOM RST2428P and SCALANCE switch families. The vulnerability requires local access with low privileges and can result in high availability impact through denial of service.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P serial servers and SCALANCE managed switches in critical infrastructure environments, particularly those utilizing CAN bus and J1939 protocol stacks for industrial automation and vehicle network communications.

Technical summary

The vulnerability exists in the Linux kernel's J1939 protocol implementation for Controller Area Network (CAN) communication. The j1939_session_new() function fails to properly increment the socket buffer reference count, creating a mismatch with j1939_session_skb_queue() behavior. This reference count underflow can lead to premature freeing of socket buffers and subsequent use-after-free conditions. The flaw is remediated by adding an explicit skb_get() call to ensure proper reference counting symmetry. The vulnerability is exploitable only with local access and low privileges, limiting attack surface to authenticated users or compromised local processes.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM and SCALANCE products per Siemens ProductCERT guidance
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT SSA-355557 for specific configuration guidance
  • Implement network segmentation to limit local access to affected industrial control devices
  • Monitor for anomalous CAN bus traffic patterns that may indicate exploitation attempts
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Review and apply Siemens security advisories for SINEC OS-based products on a recurring basis

Evidence notes

CVE published 2025-08-12 per CISA CSAF advisory ICSA-25-226-07. Siemens ProductCERT SSA-355557 provides vendor confirmation and remediation guidance. CVSS 3.1 vector confirms local attack vector with low attack complexity.

Official resources

2025-08-12