Summary
TruControl laser control software from versions 3.50.0 to 4.00.0.B use Linux kernel versions affected by CVE-2024-1086. The affected kernel vulnerability could lead to local privilege escalation.
Details
Impact
To be able to exploit this vulnerability the attacker first needs to gain any kind of user access to the system.
When logged on to the system the privilege escalation vulnerability can be exploited with following possible impacts/damages to the system:
* Data loss in the laser control
* Standstill of production
* Damage by change of the laser control
Safety is not affected since it is controlled by an independent electromechanical safety mechanism.
Remediation
* Update to the new release 4.04.0 of the TruControl software version.
* Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 4.04.0 of the TruControl software version.
Vulnerabilities 1
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…
KEV May 30, 2024
Revision history
-
#3
Fixed CSAF self-reference URL
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
TRUMPF Laser SE - PSIRT
https://www.trumpf.com/en_US/meta/security-with-trumpf/security-advisories/
-
CERT@VDE Security Advisories for TRUMPF Laser
https://certvde.com/en/advisories/vendor/trumpf-laser/
-
VDE-2024-034: Multiple TRUMPF products prone to nftables server vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2024-034