Siemens SIMATIC S7-1500 Use After Free(CVE-2025-38236)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505297);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/24");

  script_cve_id("CVE-2025-38236");

  script_name(english:"Siemens SIMATIC S7-1500 Use After Free(CVE-2025-38236)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
af_unix: Don't leave consecutive consumed OOB skbs.    Jann Horn
reported a use-after-free in unix_stream_read_generic().    The
following sequences reproduce the issue:      $ python3    from socket
import *    s1, s2 = socketpair(AF_UNIX, SOCK_STREAM)    s1.send(b'x',
MSG_OOB)    s2.recv(1, MSG_OOB)     # leave a consumed OOB skb
s1.send(b'y', MSG_OOB)    s2.recv(1, MSG_OOB)     # leave a consumed
OOB skb    s1.send(b'z', MSG_OOB)    s2.recv(1)              # recv
'z' illegally    s2.recv(1, MSG_OOB)     # access 'z' skb (use-after-
free)    Even though a user reads OOB data, the skb holding the data
stays on  the recv queue to mark the OOB boundary and break the next
recv().    After the last send() in the scenario above, the sk2's recv
queue has  2 leading consumed OOB skbs and 1 real OOB skb.    Then,
the following happens during the next recv() without MSG_OOB      1.
unix_stream_read_generic() peeks the first consumed OOB skb    2.
manage_oob() returns the next consumed OOB skb    3.
unix_stream_read_generic() fetches the next not-yet-consumed OOB skb
4. unix_stream_read_generic() reads and frees the OOB skb    , and the
last recv(MSG_OOB) triggers KASAN splat.    The 3. above occurs
because of the SO_PEEK_OFF code, which does not  expect
unix_skb_len(skb) to be 0, but this is true for such consumed  OOB
skbs.      while (skip >= unix_skb_len(skb)) {      skip -=
unix_skb_len(skb);      skb = skb_peek_next(skb,
&sk->sk_receive_queue);      ...    }    In addition to this use-
after-free, there is another issue that  ioctl(SIOCATMARK) does not
function properly with consecutive consumed  OOB skbs.    So, nothing
good comes out of such a situation.    Instead of complicating
manage_oob(), ioctl() handling, and the next  ECONNRESET fix by
introducing a loop for consecutive consumed OOB skbs,  let's not leave
such consecutive OOB unnecessarily.    Now, while receiving an OOB skb
in unix_stream_recv_urg(), if its  previous skb is a consumed OOB skb,
it is freed.    [0]:  BUG: KASAN: slab-use-after-free in
unix_stream_read_actor (net/unix/af_unix.c:3027)  Read of size 4 at
addr ffff888106ef2904 by task python3/315    CPU: 2 UID: 0 PID: 315
Comm: python3 Not tainted 6.16.0-rc1-00407-gec315832f6f9 #8
PREEMPT(voluntary)  Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.16.3-4.fc42 04/01/2014  Call Trace:   <TASK>
dump_stack_lvl (lib/dump_stack.c:122)   print_report
(mm/kasan/report.c:409 mm/kasan/report.c:521)   kasan_report
(mm/kasan/report.c:636)   unix_stream_read_actor
(net/unix/af_unix.c:3027)   unix_stream_read_generic
(net/unix/af_unix.c:2708 net/unix/af_unix.c:2847)
unix_stream_recvmsg (net/unix/af_unix.c:3048)   sock_recvmsg
(net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator
20))   __sys_recvfrom (net/socket.c:2278)   __x64_sys_recvfrom
(net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator
1) net/socket.c:2287 (discriminator 1))   do_syscall_64
(arch/x86/entry/syscall_64.c:63 (discriminator 1)
arch/x86/entry/syscall_64.c:94 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)  RIP:
0033:0x7f8911fcea06  Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8
fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48
8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5
48 83 ec 08  RSP: 002b:00007fffdb0dccb0 EFLAGS: 00000202 ORIG_RAX:
000000000000002d  RAX: ffffffffffffffda RBX: 00007fffdb0dcdc8 RCX:
00007f8911fcea06  RDX: 0000000000000001 RSI: 00007f8911a5e060 RDI:
0000000000000006  RBP: 00007fffdb0dccd0 R08: 0000000000000000 R09:
0000000000000000  R10: 0000000000000001 R11: 0000000000000202 R12:
00007f89119a7d20  R13: ffffffffc4653600 R14: 0000000000000000 R15:
0000000000000000   </TASK>    Allocated by task 315:
kasan_save_stack (mm/kasan/common.c:48)   kasan_save_track
(mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69
(discriminator 1))   __kasan_slab_alloc (mm/kasan/common.c:348)
kmem_cache_alloc_  ---truncated---

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-082556.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38236");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionStartIncluding" : "3.1.5", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AB0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware" :
        {"family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);