Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40254)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505383);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2025-40254");
  script_xref(name:"ICSA", value:"26-188-05");

  script_name(english:"Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40254)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: remove never-working support for setting nsh fields
The validation of the set(nsh(...)) action is completely wrong.  It
runs through the nsh_key_put_from_nlattr() function that is the  same
function that validates NSH keys for the flow match and the
push_nsh() action.  However, the set(nsh(...)) has a very different
memory layout.  Nested attributes in there are doubled in size in
case of the masked set().  That makes proper validation impossible.
There is also confusion in the code between the 'masked' flag, that
says that the nested attributes are doubled in size containing both
the value and the mask, and the 'is_mask' that says that the value
we're parsing is the mask.  This is causing kernel crash on trying to
write into mask part of the match with SW_FLOW_KEY_PUT() during
validation, while validate_nsh() doesn't allocate any memory for it:
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode    #PF: error_code(0x0000)
- not-present page    PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0
Oops: Oops: 0000 [#1] SMP NOPTI    CPU: 8 UID: 0 Kdump: loaded Not
tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)    RIP:
0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]    Call Trace:
<TASK>     validate_nsh+0x60/0x90 [openvswitch]
validate_set.constprop.0+0x270/0x3c0 [openvswitch]
__ovs_nla_copy_actions+0x477/0x860 [openvswitch]
ovs_nla_copy_actions+0x8d/0x100 [openvswitch]
ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]
genl_family_rcv_msg_doit+0xdb/0x130
genl_family_rcv_msg+0x14b/0x220     genl_rcv_msg+0x47/0xa0
netlink_rcv_skb+0x53/0x100     genl_rcv+0x24/0x40
netlink_unicast+0x280/0x3b0     netlink_sendmsg+0x1f7/0x430
____sys_sendmsg+0x36b/0x3a0     ___sys_sendmsg+0x87/0xd0
__sys_sendmsg+0x6d/0xd0     do_syscall_64+0x7b/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e    The third issue with this
process is that while trying to convert  the non-masked set into
masked one, validate_set() copies and doubles  the size of the
OVS_KEY_ATTR_NSH as if it didn't have any nested  attributes.  It
should be copying each nested attribute and doubling  them in size
independently.  And the process must be properly reversed  during the
conversion back from masked to a non-masked variant during  the flow
dump.    In the end, the only two outcomes of trying to use this
action are  either validation failure or a kernel crash.  And if
somehow someone  manages to install a flow with such an action, it
will most definitely  not do what it is supposed to, since all the
keys and the masks are  mixed up.    Fixing all the issues is a
complex task as it requires re-writing  most of the validation code.
Given that and the fact that this functionality never worked since
introduction, let's just remove it altogether.  It's better to  re-
introduce it later with a proper implementation instead of trying  to
fix it in stable releases.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002573/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-188-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40254");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware" :
        {"family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00'], "versionEndExcluding" : "4.0"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);