Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Use After Free (CVE-2024-49903)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503737);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/12");

  script_cve_id("CVE-2024-49903");
  script_xref(name:"ICSA", value:"25-226-07");

  script_name(english:"Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Use After Free (CVE-2024-49903)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
jfs: Fix uaf in dbFreeBits    [syzbot reported]
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common
kernel/locking/mutex.c:587 [inline]  BUG: KASAN: slab-use-after-free
in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752  Read of size 8
at addr ffff8880229254b0 by task syz-executor357/5216    CPU: 0 UID: 0
PID: 5216 Comm: syz-executor357 Not tainted
6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0  Hardware name: Google
Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:   <TASK>   __dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601   __mutex_lock_common
kernel/locking/mutex.c:587 [inline]   __mutex_lock+0xfe/0xd70
kernel/locking/mutex.c:752   dbFreeBits+0x7ea/0xd90
fs/jfs/jfs_dmap.c:2390   dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline]
dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409   dbDiscardAG+0x8a9/0xa20
fs/jfs/jfs_dmap.c:1650   jfs_ioc_trim+0x433/0x670
fs/jfs/jfs_discard.c:100   jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131
vfs_ioctl fs/ioctl.c:51 [inline]   __do_sys_ioctl fs/ioctl.c:907
[inline]   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893   do_syscall_x64
arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230
arch/x86/entry/common.c:83    Freed by task 5218:   kasan_save_stack
mm/kasan/common.c:47 [inline]   kasan_save_track+0x3f/0x80
mm/kasan/common.c:68   kasan_save_free_info+0x40/0x50
mm/kasan/generic.c:579   poison_slab_object+0xe0/0x150
mm/kasan/common.c:240   __kasan_slab_free+0x37/0x60
mm/kasan/common.c:256   kasan_slab_free include/linux/kasan.h:184
[inline]   slab_free_hook mm/slub.c:2252 [inline]   slab_free
mm/slub.c:4473 [inline]   kfree+0x149/0x360 mm/slub.c:4594
dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278   jfs_mount_rw+0x4ac/0x6a0
fs/jfs/jfs_mount.c:247   jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454
reconfigure_super+0x445/0x880 fs/super.c:1083   vfs_cmd_reconfigure
fs/fsopen.c:263 [inline]   vfs_fsconfig_locked fs/fsopen.c:292
[inline]   __do_sys_fsconfig fs/fsopen.c:473 [inline]
__se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345   do_syscall_x64
arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230
arch/x86/entry/common.c:83   entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Analysis]  There are two paths (dbUnmount and jfs_ioc_trim) that
generate race condition when accessing bmap, which leads to the
occurrence of uaf.    Use the lock s_umount to synchronize them, in
order to avoid uaf caused by race condition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-355557.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109988839/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-25-226-07");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- All affected products: Update to V3.2 or later version

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-355557 in HTML and CSAF.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-49903");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-400_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500wg_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]},
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00']},
    "cpe:/o:siemens:scalance_xc-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xc-400_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr-500wg_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr-500_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xcm-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xrm-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xch-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xrh-300_series_firmware" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);