PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38312 Siemens CVE debrief

CVE-2025-38312 is a denial-of-service issue tied to a Linux kernel framebuffer conversion path referenced in Siemens’s SIMATIC S7-1500 advisory. The problem can lead to a kernel oops if an internal refresh value overflows to zero and is then used as a divider. Siemens’s advisory lists affected SIMATIC S7-1500 CPU family products, states that no fix was available at the time of publication, and recommends access-reduction and trusted-source controls.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

OT/ICS operators using the affected Siemens SIMATIC S7-1500 or SIPLUS S7-1500 CPU models, especially environments that expose the additional GNU/Linux subsystem or allow interactive/local access to it. Security and operations teams responsible for industrial controllers should review compensating controls because the issue is availability-impacting and may result in a device crash.

Technical summary

The advisory text describes a Linux kernel fbdev/core fbcvt flaw in fb_cvt_hperiod(): if mode->refresh reaches 0x80000000 in fb_find_mode_cvt(), multiplying by 2 overflows cvt.f_refresh to 0, and that zero value is then used as a divisor, causing a kernel oops. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) matches a local, low-privilege, availability-only impact. CISA’s CSAF record maps the issue to multiple Siemens SIMATIC S7-1500 CPU family products and notes no available fix in the referenced advisory revision.

Defensive priority

Medium

Recommended defensive actions

  • Inventory the listed Siemens products and confirm whether the additional GNU/Linux subsystem is present and exposed in your deployment.
  • Restrict access to interactive shell functionality to trusted personnel only, as recommended in the advisory.
  • Allow only applications from trusted sources on affected systems.
  • Monitor Siemens ProductCERT and CISA advisory revisions for a future fix or updated mitigation guidance.
  • Treat unexpected controller crashes or kernel oops events as a security-relevant availability incident and investigate local access paths.

Evidence notes

The supplied CISA CSAF source and Siemens references identify CVE-2025-38312 as affecting Siemens SIMATIC S7-1500 CPU family products and describe the underlying Linux kernel issue as a division-by-zero in fb_cvt_hperiod() after an overflow in fb_find_mode_cvt(). The source advisory also states that no fix was available and provides mitigations focused on limiting shell access and using trusted sources. The CVSS vector in the source is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, supporting a local availability-impacting assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38312 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38312

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38312 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38312

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.