Siemens SIMATIC S7-1500 Reachable Assertion (CVE-2025-38285)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505264);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/24");

  script_cve_id("CVE-2025-38285");

  script_name(english:"Siemens SIMATIC S7-1500 Reachable Assertion (CVE-2025-38285)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix WARN() in get_bpf_raw_tp_regs    syzkaller reported an issue:
WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861
get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861  Modules
linked in:  CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted
6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full)  Hardware
name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014  RIP:
0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861
RSP: 0018:ffffc90003636fa8 EFLAGS: 00010293  RAX: 0000000000000000
RBX: 0000000000000003 RCX: ffffffff81c6bc4c  RDX: ffff888032efc880
RSI: ffffffff81c6bc83 RDI: 0000000000000005  RBP: ffff88806a730860
R08: 0000000000000005 R09: 0000000000000003  R10: 0000000000000004
R11: 0000000000000000 R12: 0000000000000004  R13: 0000000000000001
R14: ffffc90003637008 R15: 0000000000000900  FS:
0000000000000000(0000) GS:ffff8880d6cdf000(0000)
knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0:
0000000080050033  CR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4:
0000000000352ef0  DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400  Call Trace:   <TASK>   ____bpf_get_stack_raw_tp
kernel/trace/bpf_trace.c:1934 [inline]
bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931
bpf_prog_ec3b2eefa702d8d3+0x43/0x47   bpf_dispatcher_nop_func
include/linux/bpf.h:1316 [inline]   __bpf_prog_run
include/linux/filter.h:718 [inline]   bpf_prog_run
include/linux/filter.h:725 [inline]   __bpf_trace_run
kernel/trace/bpf_trace.c:2363 [inline]   bpf_trace_run3+0x23f/0x5a0
kernel/trace/bpf_trace.c:2405
__bpf_trace_mmap_lock_acquire_returned+0xfc/0x140
include/trace/events/mmap_lock.h:47
__traceiter_mmap_lock_acquire_returned+0x79/0xc0
include/trace/events/mmap_lock.h:47
__do_trace_mmap_lock_acquire_returned
include/trace/events/mmap_lock.h:47 [inline]
trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47
[inline]   __mmap_lock_do_trace_acquire_returned+0x138/0x1f0
mm/mmap_lock.c:35   __mmap_lock_trace_acquire_returned
include/linux/mmap_lock.h:36 [inline]   mmap_read_trylock
include/linux/mmap_lock.h:204 [inline]
stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157
__bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483
____bpf_get_stack kernel/bpf/stackmap.c:499 [inline]
bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline]
bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931
bpf_prog_ec3b2eefa702d8d3+0x43/0x47    Tracepoint like
trace_mmap_lock_acquire_returned may cause nested call  as the corner
case show above, which will be resolved with more general  method in
the future. As a result, WARN_ON_ONCE will be triggered. As  Alexei
suggested, remove the WARN_ON_ONCE first.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-082556.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38285");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(617);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionStartIncluding" : "3.1.5", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AB0', '6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AB0', '6ES7518-4FX00-1AC0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware" :
        {"family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);