Siemens SIMATIC S7-1500 CPU 1518 MFP NULL Pointer Dereference (CVE-2025-23143)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505666);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2025-23143");

  script_name(english:"Siemens SIMATIC S7-1500 CPU 1518 MFP NULL Pointer Dereference (CVE-2025-23143)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
When I ran the repro [0] and waited a few seconds, I observed two
LOCKDEP splats: a warning immediately followed by a null-ptr-deref.
[1]    Reproduction Steps:      1) Mount CIFS    2) Add an iptables
rule to drop incoming FIN packets for CIFS    3) Unmount CIFS    4)
Unload the CIFS module    5) Remove the iptables rule    At step 3),
the CIFS module calls sock_release() for the underlying  TCP socket,
and it returns quickly.  However, the socket remains in  FIN_WAIT_1
because incoming FIN packets are dropped.    At this point, the
module's refcnt is 0 while the socket is still  alive, so the
following rmmod command succeeds.      # ss -tan    State      Recv-Q
Send-Q Local Address:Port  Peer Address:Port    FIN-WAIT-1 0      477
10.0.2.15:51062   10.0.0.137:445      # lsmod | grep cifs    cifs
1159168  0    This highlights a discrepancy between the lifetime of
the CIFS module  and the underlying TCP socket.  Even after CIFS calls
sock_release()  and it returns, the TCP socket does not die
immediately in order to  close the connection gracefully.    While
this is generally fine, it causes an issue with LOCKDEP because  CIFS
assigns a different lock class to the TCP socket's sk->sk_lock  using
sock_lock_init_class_and_name().    Once an incoming packet is
processed for the socket or a timer fires,  sk->sk_lock is acquired.
Then, LOCKDEP checks the lock context in check_wait_context(), where
hlock_class() is called to retrieve the lock class.  However, since
the module has already been unloaded, hlock_class() logs a warning
and returns NULL, triggering the null-ptr-deref.    If LOCKDEP is
enabled, we must ensure that a module calling
sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded
while such a socket is still alive to prevent this issue.    Let's
hold the module reference in sock_lock_init_class_and_name()  and
release it when the socket is freed in sk_prot_free().    Note that
sock_lock_init() clears sk->sk_owner for svc_create_socket()  that
calls sock_lock_init_class_and_name() for a listening socket,  which
clones a socket by sk_clone_lock() without GFP_ZERO.    [0]:
CIFS_SERVER=10.0.0.137
CIFS_PATH=//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST
DEV=enp0s3  CRED=/root/WindowsCredential.txt    MNT=$(mktemp -d
/tmp/XXXXXX)  mount -t cifs ${CIFS_PATH} ${MNT} -o
vers=3.0,credentials=${CRED},cache=none,echo_interval=1    iptables -A
INPUT -s ${CIFS_SERVER} -j DROP    for i in $(seq 10);  do      umount
${MNT}      rmmod cifs      sleep 1  done    rm -r ${MNT}    iptables
-D INPUT -s ${CIFS_SERVER} -j DROP    [1]:  DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class
(kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)  Modules
linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]
CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014  RIP:
0010:hlock_class (kernel/locking/lockdep.c:234
kernel/locking/lockdep.c:223)  ...  Call Trace:   <IRQ>
__lock_acquire (kernel/locking/lockdep.c:4853
kernel/locking/lockdep.c:5178)   lock_acquire
(kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853
kernel/locking/lockdep.c:5816)   _raw_spin_lock_nested
(kernel/locking/spinlock.c:379)   tcp_v4_rcv
(./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547
net/ipv4/tcp_ipv4.c:2350)  ...    BUG: kernel NULL pointer
dereference, address: 00000000000000c4   PF: supervisor read access in
kernel mode   PF: error_code(0x0000) - not-present page  PGD 0  Oops:
Oops: 0000 [#1] PREEMPT SMP NOPTI  CPU: 10 UID: 0 PID: 0 Comm:
swapper/10 Tainted: G        W          6.14.0 #36  Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014  RIP:
0010:__lock_acquire (kernel/  ---truncated---

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-019113.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-032379.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109814144/");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-23143");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.6" :
        {"versionStartIncluding" : "3.1.6", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AB0', '6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AB0', '6ES7518-4FX00-1AC0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware" :
        {"family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);