Details of VAR-202407-1927

ID

VAR-202407-1927

CVE

CVE-2024-41004

TITLE

Linux of Linux Kernel Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2024-028679

DESCRIPTION

In the Linux kernel, the following vulnerability has been resolved: tracing: Build event generation tests only as modules The kprobes and synth event generation test modules add events and lock (get a reference) those event file reference in module init function, and unlock and delete it in module exit function. This is because those are designed for playing as modules. If we make those modules as built-in, those events are left locked in the kernel, and never be removed. This causes kprobe event self-test failure as below. [ 97.349708] ------------[ cut here ]------------ [ 97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.357106] Modules linked in: [ 97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14 [ 97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 97.363880] RIP: 0010:kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.365538] Code: a8 24 08 82 e9 ae fd ff ff 90 0f 0b 90 48 c7 c7 e5 aa 0b 82 e9 ee fc ff ff 90 0f 0b 90 48 c7 c7 2d 61 06 82 e9 8e fd ff ff 90 <0f> 0b 90 48 c7 c7 33 0b 0c 82 89 c6 e8 6e 03 1f ff 41 ff c7 e9 90 [ 97.370429] RSP: 0000:ffffc90000013b50 EFLAGS: 00010286 [ 97.371852] RAX: 00000000fffffff0 RBX: ffff888005919c00 RCX: 0000000000000000 [ 97.373829] RDX: ffff888003f40000 RSI: ffffffff8236a598 RDI: ffff888003f40a68 [ 97.375715] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 97.377675] R10: ffffffff811c9ae5 R11: ffffffff8120c4e0 R12: 0000000000000000 [ 97.379591] R13: 0000000000000001 R14: 0000000000000015 R15: 0000000000000000 [ 97.381536] FS: 0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000 [ 97.383813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.385449] CR2: 0000000000000000 CR3: 0000000002244000 CR4: 00000000000006b0 [ 97.387347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 97.389277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 97.391196] Call Trace: [ 97.391967] <TASK> [ 97.392647] ? __warn+0xcc/0x180 [ 97.393640] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.395181] ? report_bug+0xbd/0x150 [ 97.396234] ? handle_bug+0x3e/0x60 [ 97.397311] ? exc_invalid_op+0x1a/0x50 [ 97.398434] ? asm_exc_invalid_op+0x1a/0x20 [ 97.399652] ? trace_kprobe_is_busy+0x20/0x20 [ 97.400904] ? tracing_reset_all_online_cpus+0x15/0x90 [ 97.402304] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.403773] ? init_kprobe_trace+0x50/0x50 [ 97.404972] do_one_initcall+0x112/0x240 [ 97.406113] do_initcall_level+0x95/0xb0 [ 97.407286] ? kernel_init+0x1a/0x1a0 [ 97.408401] do_initcalls+0x3f/0x70 [ 97.409452] kernel_init_freeable+0x16f/0x1e0 [ 97.410662] ? rest_init+0x1f0/0x1f0 [ 97.411738] kernel_init+0x1a/0x1a0 [ 97.412788] ret_from_fork+0x39/0x50 [ 97.413817] ? rest_init+0x1f0/0x1f0 [ 97.414844] ret_from_fork_asm+0x11/0x20 [ 97.416285] </TASK> [ 97.417134] irq event stamp: 13437323 [ 97.418376] hardirqs last enabled at (13437337): [<ffffffff8110bc0c>] console_unlock+0x11c/0x150 [ 97.421285] hardirqs last disabled at (13437370): [<ffffffff8110bbf1>] console_unlock+0x101/0x150 [ 97.423838] softirqs last enabled at (13437366): [<ffffffff8108e17f>] handle_softirqs+0x23f/0x2a0 [ 97.426450] softirqs last disabled at (13437393): [<ffffffff8108e346>] __irq_exit_rcu+0x66/0xd0 [ 97.428850] ---[ end trace 0000000000000000 ]--- And also, since we can not cleanup dynamic_event file, ftracetest are failed too. To avoid these issues, build these tests only as modules. Linux of Linux Kernel Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on SINEC OS with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Multiple vulnerabilities exist in third-party components prior to SIEMENS SINEC OS V3.2. These vulnerabilities could be exploited to corrupt values, leading to undefined behavior or security issues

Trust: 2.7

sources: NVD: CVE-2024-41004 // JVNDB: JVNDB-2024-028679 // CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.2

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350

AFFECTED PRODUCTS

vendor:	linux	model:	kernel	scope:	eq	version:	6.10	Trust: 1.8
vendor:	linux	model:	kernel	scope:	gte	version:	5.11	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.6.36	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	5.10.221	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	5.6	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	6.2	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	5.16	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.9.7	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	5.15.162	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	6.7	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.1.96	Trust: 1.0
vendor:	linux	model:	kernel	scope:	eq	version:	6.7 that's all 6.9.7	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	6.2 that's all 6.6.36	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	5.11 that's all 5.15.162	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	5.16 that's all 6.1.96	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	5.6 that's all 5.10.221	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	-	Trust: 0.8
vendor:	siemens	model:	ruggedcom rst2428p	scope:	lt	version:	v3.1	Trust: 0.6
vendor:	siemens	model:	scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family	scope:	lt	version:	v3.1	Trust: 0.6
vendor:	siemens	model:	scalance xcm-/xrm-/xch-/xrh-300 family	scope:	lt	version:	v3.1	Trust: 0.6
vendor:	siemens	model:	ruggedcom rst2428p	scope:	lt	version:	v3.2	Trust: 0.6
vendor:	siemens	model:	scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family	scope:	lt	version:	v3.2	Trust: 0.6
vendor:	siemens	model:	scalance xcm-/xrm-/xch-/xrh-300 family	scope:	lt	version:	v3.2	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350 // JVNDB: JVNDB-2024-028679 // NVD: CVE-2024-41004

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2024-41004
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2024-41004
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2025-19346
value:	HIGH
Trust: 0.6
CNVD:	CNVD-2025-19350
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-19346
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
CNVD:	CNVD-2025-19350
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2024-41004
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2024-41004
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350 // JVNDB: JVNDB-2024-028679 // NVD: CVE-2024-41004

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-028679 // NVD: CVE-2024-41004

PATCH

title:	Linux Kernel Archives	url:	https://git.kernel.org/stable/c/32ef4dc2b1caf5825c0cf50646479608311cafc3	Trust: 0.8
title:	Patch for Multiple vulnerabilities in Siemens SINEC OS third-party components	url:	https://www.cnvd.org.cn/patchInfo/show/723071	Trust: 0.6
title:	Patch for Multiple vulnerabilities exist in third-party components of SIEMENS SINEC OS V3.2 and earlier	url:	https://www.cnvd.org.cn/patchInfo/show/723061	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350 // JVNDB: JVNDB-2024-028679

EXTERNAL IDS

db:	NVD	id:	CVE-2024-41004	Trust: 2.6
db:	SIEMENS	id:	SSA-613116	Trust: 1.6
db:	SIEMENS	id:	SSA-355557	Trust: 1.6
db:	SIEMENS	id:	SSA-265688	Trust: 1.0
db:	JVN	id:	JVNVU92169998	Trust: 0.8
db:	ICS CERT	id:	ICSA-25-226-07	Trust: 0.8
db:	JVNDB	id:	JVNDB-2024-028679	Trust: 0.8
db:	CNVD	id:	CNVD-2025-19346	Trust: 0.6
db:	CNVD	id:	CNVD-2025-19350	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350 // JVNDB: JVNDB-2024-028679 // NVD: CVE-2024-41004

REFERENCES

url:	https://cert-portal.siemens.com/productcert/html/ssa-613116.html	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/html/ssa-355557.html	Trust: 1.6
url:	https://git.kernel.org/stable/c/55d5d08174366efe57ca9e79964828b20c626c45	Trust: 1.0
url:	https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html	Trust: 1.0
url:	https://git.kernel.org/stable/c/98a7bfc48fffe170a60d87a5cbb7cdddf08184c3	Trust: 1.0
url:	https://git.kernel.org/stable/c/32ef4dc2b1caf5825c0cf50646479608311cafc3	Trust: 1.0
url:	https://git.kernel.org/stable/c/a85bae262ccecc52a40c466ec067f6c915e0839d	Trust: 1.0
url:	https://git.kernel.org/stable/c/3572bd5689b0812b161b40279e39ca5b66d73e88	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/html/ssa-265688.html	Trust: 1.0
url:	https://git.kernel.org/stable/c/72a0199b361df2387018697b023fdcdd357449a9	Trust: 1.0
url:	https://jvn.jp/vu/jvnvu92169998/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-41004	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07	Trust: 0.8

sources: CNVD: CNVD-2025-19346 // CNVD: CNVD-2025-19350 // JVNDB: JVNDB-2024-028679 // NVD: CVE-2024-41004

SOURCES

db:	CNVD	id:	CNVD-2025-19346
db:	CNVD	id:	CNVD-2025-19350
db:	JVNDB	id:	JVNDB-2024-028679
db:	NVD	id:	CVE-2024-41004

LAST UPDATE DATE

2026-06-19T20:27:10.226000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-19346	date:	2025-08-22T00:00:00
db:	CNVD	id:	CNVD-2025-19350	date:	2025-08-22T00:00:00
db:	JVNDB	id:	JVNDB-2024-028679	date:	2025-10-09T08:17:00
db:	NVD	id:	CVE-2024-41004	date:	2026-05-12T12:17:02.503

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-19346	date:	2025-08-12T00:00:00
db:	CNVD	id:	CNVD-2025-19350	date:	2025-08-12T00:00:00
db:	JVNDB	id:	JVNDB-2024-028679	date:	2025-10-09T00:00:00
db:	NVD	id:	CVE-2024-41004	date:	2024-07-12T13:15:21.240