Siemens SIMATIC Devices Use After Free (CVE-2024-42302)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503548);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/29");

  script_cve_id("CVE-2024-42302");

  script_name(english:"Siemens SIMATIC Devices Use After Free (CVE-2024-42302)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal  Keith
reports a use-after-free when a DPC event occurs concurrently to hot-
removal of the same portion of the hierarchy:  The dpc_handler()
awaits readiness of the secondary bus below the Downstream Port where
the DPC event occurred.  To do so, it polls the config space of the
first child device on the secondary bus.  If that child device is
concurrently removed, accesses to its struct pci_dev cause the kernel
to oops.  That's because pci_bridge_wait_for_secondary_bus() neglects
to hold a reference on the child device.  Before v6.3, the function
was only called on resume from system sleep or on runtime resume.
Holding a reference wasn't necessary back then because the pciehp IRQ
thread could never run concurrently.  (On resume from system sleep,
IRQs are not enabled until after the resume_noirq phase.  And runtime
resume is always awaited before a PCI device is removed.)  However
starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called
on a DPC event.  Commit 53b54ad074de (PCI/DPC: Await readiness of
secondary bus after reset), which introduced that, failed to
appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold
a reference on the child device because dpc_handler() and pciehp may
indeed run concurrently.  The commit was backported to v5.10+ stable
kernels, so that's the oldest one affected.  Add the missing reference
acquisition.  Abridged stack trace:    BUG: unable to handle page
fault for address: 00000000091400c0   CPU: 15 PID: 2464 Comm:
irq/53-pcie-dpc 6.9.0   RIP: pci_bus_read_config_dword+0x17/0x50
pci_dev_wait()   pci_bridge_wait_for_secondary_bus()
dpc_reset_link()   pcie_do_recovery()   dpc_handler()

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-42302");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);