PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-57901 Siemens CVE debrief

A vulnerability in the Linux kernel's af_packet subsystem allows local attackers to trigger a kernel crash (denial of service) when using the MSG_PEEK flag with packet socket operations. The flaw exists in vlan_get_protocol_dgram(), which incorrectly modifies socket buffer (skb) state during peek operations, leading to skb_under_panic and a kernel BUG assertion. This vulnerability was discovered by syzbot and affects Siemens SIMATIC S7-1500 TM MFP industrial control systems that include a GNU/Linux subsystem. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector with low complexity and high availability impact. No patch is currently available from the vendor; mitigations focus on restricting access to trusted personnel and running only trusted applications.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-01-15
Original CVE updated
2026-08-04
Advisory published
2025-01-15
Advisory updated
2026-08-04

Who should care

Industrial control system operators using Siemens SIMATIC S7-1500 TM MFP with GNU/Linux subsystem; Linux kernel maintainers; OT security teams managing packet socket applications; organizations running custom networking applications on embedded Linux systems in critical infrastructure.

Technical summary

The vulnerability resides in net/packet/af_packet.c in the vlan_get_protocol_dgram() function. When handling packet socket receive operations with the MSG_PEEK flag, the function incorrectly pushes data onto the socket buffer (skb), causing skb->data to underflow below skb->head. This triggers skb_under_panic() and a kernel BUG assertion, resulting in system crash. The root cause is that the blamed commit added VLAN protocol handling without accounting for MSG_PEEK semantics, which should not modify skb state. The fix restructures vlan_get_protocol_dgram() to operate without touching the skb, enabling safe concurrent use across multiple CPUs, and adds const qualification to prevent modification. The crash was reproduced by syzbot using syz-executor883 on kernel 6.13.0-rc4 with KASAN and PTI enabled.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem on affected Siemens SIMATIC S7-1500 TM MFP devices to trusted personnel only
  • Implement application whitelisting to ensure only trusted applications are built and executed on the GNU/Linux subsystem
  • Monitor for anomalous local process activity involving packet socket operations
  • Apply vendor patches when released by Siemens
  • Review network segmentation to limit exposure of affected industrial control systems

Evidence notes

The vulnerability description and stack trace are sourced from CISA ICS advisory ICSA-24-102-01, which references Siemens security advisory SSA-265688. The kernel crash dump shows skb_under_panic at net/core/skbuff.c:206 triggered through vlan_get_protocol_dgram() → skb_push() call chain during packet_recvmsg() with MSG_PEEK. The fix involves reworking vlan_get_protocol_dgram() to not modify the skb and adding const qualifier for safe concurrent access.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-57901 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-57901

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-57901 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-57901

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.