Full Report
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
Analysis Summary
# Vulnerability: Multiple Flaws in SIMATIC S7-1500 CPU 1518 MFP GNU/Linux Subsystem
## CVE Details
- **CVE ID:** Multiple (including CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, and others)
- **CVSS Score:** 10.0 (CVSS v3.1) / 8.7 (CVSS v4.0)
- **CWE:**
- CWE-416: Use After Free
- CWE-20: Improper Input Validation
- CWE-457: Use of Uninitialized Variable
- CWE-667: Improper Locking
## Affected Systems
- **Products:**
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
- SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
- SIPLUS variants of the above.
- **Versions:** Firmware version V3.1.7 and all versions >= V3.1.7.
- **Configurations:** Systems utilizing the integrated GNU/Linux subsystem (C/C++ Runtime) for additional application processing.
## Vulnerability Description
This advisory covers a wide range of security flaws residing within the Linux kernel and associated subsystems used by the S7-1500 MFP's Linux environment. Key technical flaws include:
- **CVE-2025-39871:** A "Use-After-Free" in the `dmaengine` (idxd driver) caused by improper reference count management (`put_device`), leading to potential memory corruption or system instability.
- **CVE-2025-39931:** Improper input validation in the `af_alg_sendmsg` crypto interface, where uninitialized variables could trigger a system crash.
- **CVE-2025-39953:** A race condition/deadlock in `cgroup` root destruction leading to hung tasks.
## Exploitation
- **Status:** Not exploited in the wild (as per available documentation).
- **Complexity:** Ranges from Low to Medium (depending on the specific CVE).
- **Attack Vector:** Primarily Local or Network (depending on which service/subsystem is targeted within the Linux environment). The critical CVSS 10 score suggests that some vulnerabilities may be remotely exploitable under specific configurations.
## Impact
- **Confidentiality:** High (Potential for memory disclosure).
- **Integrity:** High (Potential for unauthorized modification of kernel state).
- **Availability:** High (System crash, kernel panic, or hung tasks).
## Remediation
### Patches
- Siemens is currently **preparing fixes** for the affected products. No firmware updates are currently available at the time of this publication (V1.0).
### Workarounds
- **Network Isolation:** Ensure the MFP's Linux subsystem interfaces are not exposed to untrusted networks.
- **Restrict Access:** Limit access to the Linux environment to authorized users only, minimizing the risk of local exploitation.
- **Defense in Depth:** Implement standard industrial security measures (e.g., cell protection, firewalls).
## Detection
- **Indicators of Compromise:** Unusual kernel warnings in logs (e.g., `refcount_t: underflow`), unexpected system reboots, or hung cgroup-related processes.
- **Detection methods and tools:** Monitor system logs via the Linux subsystem's standard logging mechanisms for stability issues or unauthorized access attempts.
## References
- **Vendor Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-457936.html
- **CISA/Siemens Security Resources:** hxxps://www.siemens[.]com/cert