Siemens SIMATIC Devices Loop with Unreachable Exit Condition (CVE-2024-35886)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503497);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/29");

  script_cve_id("CVE-2024-35886");

  script_name(english:"Siemens SIMATIC Devices Loop with Unreachable Exit Condition (CVE-2024-35886)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix infinite recursion in fib6_dump_done().    syzkaller
reported infinite recursive calls of fib6_dump_done() during  netlink
socket destruction.    From the log, syzkaller sent an AF_UNSPEC
RTM_GETROUTE message, and then  the response was generated.  The
following recvmmsg() resumed the dump  for IPv6, but the first call of
inet6_dump_fib() failed at kzalloc() due  to the fault injection.
12:01:34 executing program 3:    r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, ... snip ...)    recvmmsg(r0, ... snip ...)
(fail_nth: 8)    Here, fib6_dump_done() was set to
nlk_sk(sk)->cb.done, and the next call  of inet6_dump_fib() set it to
nlk_sk(sk)->cb.args[3].  syzkaller stopped  receiving the response
halfway through, and finally netlink_sock_destruct()  called
nlk_sk(sk)->cb.done().    fib6_dump_done() calls fib6_dump_end() and
nlk_sk(sk)->cb.done() if it  is still not NULL.  fib6_dump_end()
rewrites nlk_sk(sk)->cb.done() by  nlk_sk(sk)->cb.args[3], but it has
the same function, not NULL, calling  itself recursively and hitting
the stack guard page.    To avoid the issue, let's set the destructor
after kzalloc().

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-35886");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(835);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);