Is CVE-2024-23848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23848 being exploited in the wild.

How severe is CVE-2024-23848?

Medium severity, with a CVSS score of 5.5, published 23 January 2024.

Which products and versions are affected?

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

Is there a fix for CVE-2024-23848?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-23848 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2024-23848?

Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23848: Linux Kernel use-after-free in CEC framework

CVE-2024-23848 · Severity: medium · CVSS 5.5 · Published 2024-01-23

A vulnerability exists in the Linux kernel's Consumer Electronics Control (CEC) framework, which manages communication between multimedia devices like TVs and players. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized control over the system. This affects various Linux-based systems, including industrial automation components like the Siemens SIMATIC S7-1500.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Vendors: Linux, Siemens.

Quick answers

Is CVE-2024-23848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23848 being exploited in the wild.
How severe is CVE-2024-23848?: Medium severity, with a CVSS score of 5.5, published 23 January 2024.
Which products and versions are affected?: Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.
Is there a fix for CVE-2024-23848?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-23848 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2024-23848?: Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the cec_queue_msg_fh function within drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. The flaw is caused by a race condition where one thread holds a lock on a 'struct cec_fh' while another thread frees the same structure without proper synchronization. When the first thread subsequently attempts to access the freed memory (specifically fh->msgs), a KASAN-detected slab-use-after-free occurs. This can be triggered via the cec_ioctl system call. While primarily resulting in a kernel crash (DoS), the presence of function pointers in the affected structure suggests a potential for privilege escalation.

Affected products

Linux Linux Kernel up to and including 6.7.1
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

Timeline

2024-01-18: disclosed: Vulnerability details shared on Linux Kernel Mailing List (LKML)
2024-01-23: advisory: CVE-2024-23848 published by MITRE/NVD
2024-04-09: advisory: Siemens published advisory SSA-265688 confirming impact on SIMATIC S7-1500 TM MFP

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.