Siemens SIMATIC S7-1500 Improper Handling of Exceptional Conditions (CVE-2024-53140)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(504020);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/05");

  script_cve_id("CVE-2024-53140");

  script_name(english:"Siemens SIMATIC S7-1500 Improper Handling of Exceptional Conditions (CVE-2024-53140)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
netlink: terminate outstanding dump on socket close Netlink supports
iterative dumping of data. It provides the families the following ops:
- start - (optional) kicks off the dumping process - dump - actual
dump helper, keeps getting called until it returns 0 - done -
(optional) pairs with .start, can be used for cleanup The whole
process is asynchronous and the repeated calls to .dump don't actually
happen in a tight loop, but rather are triggered in response to
recvmsg() on the socket. This gives the user full control over the
dump, but also means that the user can close the socket without
getting to the end of the dump. To make sure .start is always paired
with .done we check if there is an ongoing dump before freeing the
socket, and if so call .done. The complication is that sockets can get
freed from BH and .done is allowed to sleep. So we use a workqueue to
defer the call, when needed. Unfortunately this does not work
correctly. What we defer is not the cleanup but rather releasing a
reference on the socket. We have no guarantee that we own the last
reference, if someone else holds the socket they may release it in BH
and we're back to square one. The whole dance, however, appears to be
unnecessary. Only the user can interact with dumps, so we can clean up
when socket is closed. And close always happens in process context.
Some async code may still access the socket after close, queue
notification skbs to it etc. but no dumps can start, end or otherwise
make progress. Delete the workqueue and flush the dump state directly
from the release handler. Note that further cleanup is possible in
-next, for instance we now always call .done before releasing the main
module reference, so dump doesn't have to take a reference of its own.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-398330.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109478459/");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-53140");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(755);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AB0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);