PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-57929 Siemens CVE debrief

CVE-2024-57929 is a double-free vulnerability in the Linux kernel's device-mapper (dm) array subsystem, specifically within the `dm_array_cursor_end()` function. The flaw occurs when `dm_bm_read_lock()` fails due to locking or checksum errors, implicitly releasing the faulty block while leaving an invalid pointer. The `dm_array_cursor` incorrectly caches this invalid pointer, leading to a double release when `dm_array_cursor_end()` is subsequently called, which triggers a `BUG_ON` assertion in `dm-bufio cache_put()`. This vulnerability affects Siemens SIMATIC S7-1500 TM MFP devices running the GNU/Linux subsystem. The CVSS 3.1 score of 6.7 (MEDIUM) reflects local attack vector, low attack complexity, and high privileges required, with high impacts to confidentiality, integrity, and availability. No patch is currently available from Siemens; mitigations focus on restricting access to trusted personnel and ensuring only trusted applications are executed.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem enabled, particularly in industrial automation and critical infrastructure environments. Security teams responsible for embedded Linux systems in OT/ICS environments should prioritize access controls until a patch becomes available.

Technical summary

The vulnerability exists in the Linux kernel's device-mapper array cursor implementation. When `dm_bm_read_lock()` encounters a locking or checksum error, it releases the block internally but leaves an invalid `dm_block` pointer. The `dm_array_cursor` caches this invalid pointer, and when `dm_array_cursor_end()` is called, it attempts to release the already-freed block a second time. This double-free triggers a `BUG_ON` in `dm-bufio cache_put()`, causing a kernel panic. The flaw requires local access with high privileges to exploit, limiting its attack surface but resulting in complete system compromise if triggered.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Ensure only applications from trusted sources are built and executed on affected devices
  • Monitor for Siemens security advisory updates regarding patch availability
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance
  • Review and implement ICS-CERT recommended practices for securing embedded Linux subsystems

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-102-01, which references Siemens security advisory SSA-265688. The flaw was resolved in the upstream Linux kernel. Siemens has confirmed no fix is currently available for the affected product. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates a local attack requiring high privileges.

Official resources

2024-04-09