CVE-2024-49894: simatic s7-1500 tm mfp firmware 1.1; +5 more affected products

Affected technology

simatic s7-1500 tm mfp firmware · 1.1
siemens

debian linux · 11.0
debian

linux kernel · from 4.15 (inclusive), before 4.19.323 (exclusive)
linux

linux kernel · from 4.20 (inclusive), before 5.4.285 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.227 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.168 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.113 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.55 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.10.14 (exclusive)
linux

linux kernel · from 6.11 (inclusive), before 6.11.3 (exclusive)
linux

sinec os · before 3.2 (exclusive)
siemens

Linux · 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before b3dfa878257a7e98830b3009ca5831a01d8f85fc, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before f5f6d90087131812c1e4b9d3103f400f1624396d, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before c130a3c09e3746c1a09ce26c20d21d449d039b1d, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before c6979719012a90e5b8e3bc31725fbfdd0b9b2b79, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before 2495c8e272d84685403506833a664fad932e453a, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before 122e3a7a8c7bcbe3aacddd6103f67f9f36bed473, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before 2f5da549535be8ccd2ab7c9abac8562ad370b181, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before 07078fa5d589a7fbce8f81ea8acf7aa0021ab38e, 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c to before b7e99058eb2e86aabd7a10761e76cae33d22b49f
Linux

Linux · 4.15
Linux

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · 0 to before V1.1.1
Siemens

Component: Not specified by the source
Function: points, returns
File: drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality and availability impact as high; integrity impact as none. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.