Siemens RUGGEDCOM RST2428P Improper Update of Reference Count (CVE-2025-40251)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505394);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2025-40251");
  script_xref(name:"ICSA", value:"26-188-05");

  script_name(english:"Siemens RUGGEDCOM RST2428P Improper Update of Reference Count (CVE-2025-40251)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy    The
function devl_rate_nodes_destroy is documented to Unset parent for
all rate objects. However, it was only calling the driver-specific
`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing
the parent's refcount, without actually setting the
`devlink_rate->parent` pointer to NULL.    This leaves a dangling
pointer in the `devlink_rate` struct, which cause  refcount error in
netdevsim[1] and mlx5[2]. In addition, this is  inconsistent with the
behavior of `devlink_nl_rate_parent_node_set`,  where the parent
pointer is correctly cleared.    This patch fixes the issue by
explicitly setting `devlink_rate->parent`  to NULL after notifying the
driver, thus fulfilling the function's  documented behavior for all
rate objects.    [1]  repro steps:  echo 1 >
/sys/bus/netdevsim/new_device  devlink dev eswitch set
netdevsim/netdevsim1 mode switchdev  echo 1 >
/sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs  devlink port
function rate add netdevsim/netdevsim1/test_node  devlink port
function rate set netdevsim/netdevsim1/128 parent test_node  echo 1 >
/sys/bus/netdevsim/del_device    dmesg:  refcount_t: decrement hit 0;
leaking memory.  WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31
refcount_warn_saturate+0x42/0xe0  CPU: 8 UID: 0 PID: 1530 Comm: bash
Not tainted 6.18.0-rc4+ #1 NONE  Hardware name: QEMU Standard PC (Q35
+ ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org
04/01/2014  RIP: 0010:refcount_warn_saturate+0x42/0xe0  Call Trace:
<TASK>   devl_rate_leaf_destroy+0x8d/0x90
__nsim_dev_port_del+0x6c/0x70 [netdevsim]
nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]
nsim_drv_remove+0x2b/0xb0 [netdevsim]
device_release_driver_internal+0x194/0x1f0
bus_remove_device+0xc6/0x130   device_del+0x159/0x3c0
device_unregister+0x1a/0x60   del_device_store+0x111/0x170 [netdevsim]
kernfs_fop_write_iter+0x12e/0x1e0   vfs_write+0x215/0x3d0
ksys_write+0x5f/0xd0   do_syscall_64+0x55/0x10f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53    [2]  devlink dev eswitch
set pci/0000:08:00.0 mode switchdev  devlink port add pci/0000:08:00.0
flavour pcisf pfnum 0 sfnum 1000  devlink port function rate add
pci/0000:08:00.0/group1  devlink port function rate set
pci/0000:08:00.0/32768 parent group1  modprobe -r mlx5_ib mlx5_fwctl
mlx5_core    dmesg:  refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31
refcount_warn_saturate+0x42/0xe0  CPU: 7 UID: 0 PID: 16151 Comm: bash
Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014  RIP:
0010:refcount_warn_saturate+0x42/0xe0  Call Trace:   <TASK>
devl_rate_leaf_destroy+0x8d/0x90
mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]
mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]
mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]
mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]
notifier_call_chain+0x33/0xa0   blocking_notifier_call_chain+0x3b/0x50
mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]
mlx5_eswitch_disable+0x63/0x90 [mlx5_core]   mlx5_unload+0x1d/0x170
[mlx5_core]   mlx5_uninit_one+0xa2/0x130 [mlx5_core]
remove_one+0x78/0xd0 [mlx5_core]   pci_device_remove+0x39/0xa0
device_release_driver_internal+0x194/0x1f0   unbind_store+0x99/0xa0
kernfs_fop_write_iter+0x12e/0x1e0   vfs_write+0x215/0x3d0
ksys_write+0x5f/0xd0   do_syscall_64+0x53/0x1f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002573/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-188-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40251");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(911);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware" :
        {"family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00'], "versionEndExcluding" : "4.0"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);