CyberSecBulletin
CVE-2022-40304NVD status: Modified

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Double Free

Published Updated By the CyberSecBulletin desk

CVE-2022-40304 is a high-severity double free vulnerability in SIMATIC S7-1500 CPU 1518-4 PN/DP MFP from Siemens, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists version V3.1.5 as the first without the flaw, so updating SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 5.81% chance of exploitation within 30 days, which is in the top 6.74% of all scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to V3.1.5 or a later version.
  2. Update SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to V3.1.5 or a later version.
  3. Update SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to V3.1.5 or a later version.
  4. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
XmlsoftLibxml2before 2.10.32.10.3
NetAppActive Iq Unified ManagerNot specified in the recordNot stated
NetAppClustered Data OntapNot specified in the recordNot stated
NetAppClustered Data Ontap Antivirus ConnectorNot specified in the recordNot stated
NetAppManageability Software Development KitNot specified in the recordNot stated
NetAppSmi-s ProviderNot specified in the recordNot stated
NetAppSnapmanagerNot specified in the recordNot stated
NetAppH300s FirmwareNot specified in the recordNot stated
NetAppH500s FirmwareNot specified in the recordNot stated
NetAppH700s FirmwareNot specified in the recordNot stated
NetAppH410s FirmwareNot specified in the recordNot stated
NetAppH410c FirmwareNot specified in the recordNot stated
AppleiPadOSbefore 15.7.215.7.2
AppleIphone OSbefore 15.7.215.7.2
ApplemacOS11.0 up to, but not including, 11.7.2; 12.0 up to, but not including, 12.6.211.7.2, 12.6.2
AppletvOSbefore 16.216.2
ApplewatchOSbefore 9.29.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)

Official description

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Double Free

The product calls free() twice on the same memory address.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Use a static analysis tool to find double free instances.

More Double Free vulnerabilities (CWE-415)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Third-party and government advisories

Other vulnerabilities in SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

All SIMATIC S7-1500 CPU 1518-4 PN/DP MFP vulnerabilities

Recent Double Free vulnerabilities

Spotted an error? Tell us.