PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-57948 Siemens CVE debrief

CVE-2024-57948 is a medium-severity vulnerability (CVSS 6.7) in the Linux kernel's mac802154 subsystem, affecting IEEE 802.15.4 wireless personal area network implementations. The flaw involves a corrupted list condition in ieee802154_if_remove that occurs when removing an IEEE 802.15.4 network interface after unregistering the corresponding hardware device. The vulnerability was discovered through syzkaller kernel fuzzing and has been resolved in the upstream Linux kernel. Siemens has identified this vulnerability as affecting the GNU/Linux subsystem of their SIMATIC S7-1500 TM MFP industrial control product. As of the source publication, no vendor patch is available for the affected Siemens product.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled; OT security teams managing IEEE 802.15.4 wireless sensor networks; Linux kernel maintainers for embedded/ICS distributions; security teams responsible for defense-in-depth strategies for industrial environments

Technical summary

The vulnerability exists in the mac802154 Linux kernel subsystem that implements the IEEE 802.15.4 low-rate wireless personal area network standard. When an IEEE 802.15.4 hardware device is unregistered from the system, subsequent removal of the network interface can trigger a corrupted linked list condition in ieee802154_if_remove. The root cause is improper validation of local interface state before manipulating the sdata (station data) list structure. The fix adds checks to verify local interface state prior to list deletion operations. This vulnerability requires local access with high privileges to exploit, resulting in potential confidentiality, integrity, and availability impacts on the affected system.

Defensive priority

medium

Recommended defensive actions

  • Limit access to the interactive shell of the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for Siemens security advisories for patch availability
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The vulnerability description indicates this was a kernel-level memory corruption issue in the mac802154 (IEEE 802.15.4 MAC) subsystem, specifically in the ieee802154_if_remove function. The fix involves checking local interfaces before deleting the sdata list to prevent list corruption. The syzkaller reference [1] indicates this was found through automated kernel fuzzing. Siemens has assigned this CVE to their SIMATIC S7-1500 TM MFP product's GNU/Linux subsystem, indicating the product uses a vulnerable Linux kernel version.

Official resources

2024-04-09