Information disclosure in Siemens SIMATIC IPCs

1) Information exposure through microarchitectural state after transient execution

EUVDB-ID: #VU79262

Risk: Medium

CVSSv3.1: 8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-40982

CWE-ID: CWE-1342 - Information Exposure through Microarchitectural State after Transient Execution

Exploit availability: No

Description

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to the way data is shared between threads whereby the AVX GATHER instructions on Intel processors can forward the content of stale vector registers to dependent instructions. A malicious guest can infer data from different contexts on the same core and execute arbitrary code with elevated privileges.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

SIMATIC IPC RW-543A: All versions

SIMATIC IPC PX-39A PRO: All versions

SIMATIC IPC PX-39A: All versions

SIMATIC IPC BX-39A: All versions

SIMATIC IPC847E: All versions

SIMATIC IPC677E: All versions

SIMATIC IPC647E: All versions

SIMATIC IPC627E: All versions

SIMATIC Field PG M6: All versions

CPE2.3

• cpe:2.3:h:siemens:simatic_ipc_rw-543a:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc_px-39a_pro:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc_px-39a:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc_bx-39a:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc847e:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc677e:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc647e:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_ipc627e:*:*:*:*:*:*:*:
• cpe:2.3:h:siemens:simatic_field_pg_m6:*:*:*:*:*:*:*:

External links

http://cert-portal.siemens.com/productcert/txt/ssa-981975.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.