Siemens SIMATIC Devices Improper Initialization (CVE-2024-35910)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503782);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/29");

  script_cve_id("CVE-2024-35910");

  script_name(english:"Siemens SIMATIC Devices Improper Initialization (CVE-2024-35910)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
tcp: properly terminate timers for kernel sockets We had various
syzbot reports about tcp timers firing after the corresponding netns
has been dismantled. Fortunately Josef Bacik could trigger the issue
more often, and could test a patch I wrote two years ago. When TCP
sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the
timers. inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held. This is the reason it uses
sk_stop_timer(), aka del_timer(). This means that ongoing timers might
finish much later. For user sockets, this is fine because each running
timer holds a reference on the socket, and the user socket holds a
reference on the netns. For kernel sockets, we risk that the netns is
freed before timer can complete, because kernel sockets do not hold
reference on the netns. This patch adds
inet_csk_clear_xmit_timers_sync() function that using
sk_stop_timer_sync() to make sure all timers are terminated before the
kernel socket is released. Modules using kernel sockets close them in
their netns exit() handler. Also add sock_not_owned_by_me() helper to
get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be
called while socket lock is held. It is very possible we can revert in
the future commit 3a58f13a881e (net: rds: acquire refcount on TCP
sockets) which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code) We
probably can remove the check_net() tests from tcp_out_of_resources()
and __tcp_close() in the future.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-398330.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109478459/");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-35910");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(665);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6ES7518-4FX00-1AB0', '6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AC0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']},
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp_firmware" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);