Full Report
Security researchers published information on vulnerabilities known as Spectre, Meltdown, Spectre-NG, Lazy FP State Restore, Spectre V1.1, and L1 Terminal Fault/Foreshadow. These vulnerabilities affect many modern processors from different vendors to a varying degree. Siemens is analyzing the impact of these vulnerabilities and of the mitigations released on its own products. If Siemens products are found to be affected, additional product-specific update information will be distributed either via the Siemens ProductCERT website or through Siemens’ customer service organizations if applicable.
Analysis Summary
# Vulnerability: Speculative Execution Side-Channel Vulnerabilities (Spectre, Meltdown, and Variants)
## CVE Details
- **CVE ID:** CVE-2017-5753 (Spectre V1), CVE-2017-5715 (Spectre V2), CVE-2017-5754 (Meltdown), CVE-2018-3640 (Spectre-NG V3a), CVE-2018-3639 (Spectre-NG V4/SSBD), CVE-2018-3665 (Lazy FP), CVE-2018-3693 (Spectre V1.1), CVE-2018-3615/3620/3646 (L1TF/Foreshadow)
- **CVSS Score:** Range 4.3 to 7.9 (Medium to High)
- **CWE:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
## Affected Systems
- **Products:** Broad range of Siemens industrial products incorporating modern microprocessors (Intel, AMD, ARM). This includes SIMATIC Industrial PCs, S7 Controllers, and Ruggedcom devices.
- **Versions:** Multiple versions across Siemens product lines using affected CPU architectures.
- **Configurations:** Systems running modern operating systems with speculative execution enabled in the CPU hardware.
## Vulnerability Description
These vulnerabilities leverage **speculative execution**, a performance-optimization technique where processors guess the path of a program and execute instructions before they are confirmed.
- **Spectre/Spectre-NG:** Breaks the isolation between different applications by tricking the processor into executing unintended code paths, leaking data via side channels.
- **Meltdown:** Allows a process to read the entire kernel memory, bypassing the fundamental isolation between user applications and the operating system.
- **L1TF (Foreshadow):** Specifically targets Intel SGX enclaves and L1 Data Cache to extract information from protected memory regions.
## Exploitation
- **Status:** PoC available. While these flaws are well-documented, "in the wild" exploitation is difficult to detect due to the lack of traditional log footprints.
- **Complexity:** High (requires sophisticated knowledge of CPU architecture and timing attacks).
- **Attack Vector:** Local (Requires the ability to execute code on the target system).
## Impact
- **Confidentiality:** High (Unauthorized access to sensitive data in memory, including passwords and encryption keys).
- **Integrity:** None.
- **Availability:** None.
## Remediation
### Patches
- Siemens advises checking the **Siemens ProductCERT** portal for product-specific firmware updates.
- Apply Operating System (OS) security updates (Microsoft, Linux distributions) that include software-level mitigations (e.g., KPTI, Retpoline).
- Apply BIOS/UEFI updates from hardware vendors to update CPU Microcode.
### Workarounds
- Disable "Simultaneous Multithreading" (SMT/Hyper-Threading) in BIOS where critical isolation is required.
- Isolate sensitive systems from untrusted networks to prevent the initial execution of malicious code.
- Minimize the execution of untrusted scripts (e.g., JavaScript) in web browsers on Industrial PCs.
## Detection
- **Indicators of compromise:** Extremely difficult to detect as the exploitation does not leave standard audit log entries.
- **Detection methods and tools:**
- Use vendor-provided tools (e.g., Intel’s Speculative Execution Detection Tool).
- Utilize OS-specific scripts (e.g., `Get-SpeculationControlSettings` for PowerShell or `spectre-meltdown-checker` for Linux) to verify mitigation status.
## References
- Siemens ProductCERT: hxxps[://]new[.]siemens[.]com/global/en/products/services/cert[.]html
- Intel Security Advisory: hxxps[://]www[.]intel[.]com/content/www/us/en/security-center/advisory/intel-sa-00088[.]html
- CVE Details: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2017-5754