SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: Access of Resource Using Incompatible Type
CVE-2022-34918 is a high-severity access of resource using incompatible type vulnerability in SIMATIC S7-1500 TM MFP - GNU/Linux subsystem from Siemens, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version V1.1 as the first without the flaw, so updating SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 5.45% chance of exploitation within 30 days, which is in the top 7.14% of all scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1 or a later version.
- Update Linux Kernel to 4.14.316 or 4.19.284 or 5.4.244 or 5.10.130, whichever matches your release line, or a later version.
- Read the advisory on git.kernel.org for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1 | V1.1 |
| Linux | Linux Kernel | 4.1 up to, but not including, 4.14.316; 4.15 up to, but not including, 4.19.284; 4.20 up to, but not including, 5.4.244; 5.5 up to, but not including, 5.10.130; 5.11 up to, but not including, 5.15.54; 5.16 up to, but not including, 5.18.11 | 4.14.316, 4.19.284, 5.4.244, 5.10.130, 5.15.54, 5.18.11 |
| Debian | Debian Linux | 11.0 | Not stated |
| Canonical | Ubuntu Linux | 14.04; 16.04; 18.04; 20.04; 22.04 | Not stated |
| NetApp | H300s Firmware | Not specified in the record | Not stated |
| NetApp | H500s Firmware | Not specified in the record | Not stated |
| NetApp | H700s Firmware | Not specified in the record | Not stated |
| NetApp | H410s Firmware | Not specified in the record | Not stated |
| NetApp | H410c Firmware | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | NVD |
| CVSS 2.0 | 7.2 | High | NVD |
Official description
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Access of Resource Using Incompatible Type
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
More Access of Resource Using Incompatible Type vulnerabilities (CWE-843)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlThird Party Advisory, VDB Entry
- openwall.com/lists/oss-security/2022/08/06/5Mailing List, Third Party Advisory
- security.netapp.com/advisory/ntap-20220826-0004/Third Party Advisory
- debian.org/security/2022/dsa-5191Third Party Advisory
Technical write-ups (may include proof of concept)
- packetstormsecurity.com/files/168543/Netfilter-nft_set_elem_init-Heap-Overflow-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- openwall.com/lists/oss-security/2022/07/05/1Exploit, Mailing List, Third Party Advisory
- openwall.com/lists/oss-security/2022/07/02/3Exploit, Mailing List, Third Party Advisory
- randorisec.fr/crack-linux-firewall/Exploit, Third Party Advisory
Other references
Other vulnerabilities in SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- 7.8 High severity
- 7.8 High severity
Linux Kernel Unspecified Exploited
- 8.8 High severity
- 7.8 High severity
- 8.8 High severity
- 8.2 High severity
Recent Access of Resource Using Incompatible Type vulnerabilities
- 8.2 High severity
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Google Chromium V8 Type Confusion Exploited
Spotted an error? Tell us.