Siemens SIMATIC S7-1500 NULL Pointer Dereference (CVE-2025-38100)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505290);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/24");

  script_cve_id("CVE-2025-38100");

  script_name(english:"Siemens SIMATIC S7-1500 NULL Pointer Dereference (CVE-2025-38100)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is
invoked from exit_thread() when a task exists or when a fork fails. In
the latter case the exit_thread() cleans up resources which were
allocated during fork(). io_bitmap_exit() invokes
task_update_io_bitmap(), which in turn ends up in
tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current
task. If current has TIF_IO_BITMAP set, but no bitmap installed,
tss_update_io_bitmap() crashes with a NULL pointer dereference. There
are two issues, which lead to that problem: 1) io_bitmap_exit() should
not invoke task_update_io_bitmap() when the task, which is cleaned up,
is not the current task. That's a clear indicator for a cleanup after
a failed fork(). 2) A task should not have TIF_IO_BITMAP set and
neither a bitmap installed nor IOPL emulation level 3 activated. This
happens when a kernel thread is created in the context of a user space
thread, which has TIF_IO_BITMAP set as the thread flags are copied and
the IO bitmap pointer is cleared. Other than in the failed fork() case
this has no impact because kernel threads including IO workers never
return to user space and therefore never invoke
tss_update_io_bitmap(). Cure this by adding the missing cleanups and
checks: 1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap()
if the to be cleaned up task is not the current task. 2) Clear
TIF_IO_BITMAP in copy_thread() unconditionally. For user space forks
it is set later, when the IO bitmap is inherited in io_bitmap_share().
For paranoia sake, add a warning into tss_update_io_bitmap() to catch
the case, when that code is invoked with inconsistent state

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-082556.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38100");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionStartIncluding" : "3.1.5", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AB0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware" :
        {"family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);