-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-534763: Special Register Buffer Data Sampling (SRBDS) aka Crosstalk in
Industrial Products

Publication Date:        2020-09-08
Last Update:             2021-02-09
Current Version:         1.3
CVSS v3.1 Base Score:    5.5

SUMMARY
=======

Security researchers published information on a vulnerability known as
Crosstalk (INTEL-SA-00320). This vulnerability affects modern Intel
processors to a varying degree.

Several Siemens Industrial Products contain processors that are affected
by the vulnerability.

Siemens is preparing updates and recommends specific countermeasures
until fixes are available.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIMATIC Field PG M4 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC Field PG M5 
  - Affected versions:
       All BIOS versions < V22.01.08
  - Remediation:
       Update BIOS to V22.01.08
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC Field PG M6 
  - Affected versions:
       All BIOS versions < V26.01.07
  - Remediation:
       Update BIOS to V26.01.07
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC3000 SMART 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC347E 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC427D (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC427E (incl. SIPLUS variants) 
  - Affected versions:
       All BIOS versions < V21.01.14
  - Remediation:
       Update BIOS to V21.01.14
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC477D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC477E 
  - Affected versions:
       All BIOS versions < V21.01.14
  - Remediation:
       Update BIOS to V21.01.14
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC477E Pro 
  - Affected versions:
       All BIOS versions < V21.01.14
  - Remediation:
       Update BIOS to V21.01.14
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC527G 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC547E 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC547G 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC627D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC627E 
  - Affected versions:
       All BIOS versions < V25.02.06
  - Remediation:
       Update BIOS to V25.02.06
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC647D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC647E 
  - Affected versions:
       All BIOS versions < V25.02.06
  - Remediation:
       Update BIOS to V25.02.06
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC677D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC677E 
  - Affected versions:
       All BIOS versions < V25.02.06
  - Remediation:
       Update BIOS to V25.02.06
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC IPC827D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC847D 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC847E 
  - Affected versions:
       All BIOS versions < V25.02.06
  - Remediation:
       Update BIOS to V25.02.06
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763408

* SIMATIC ITP1000 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMOTION P320-4E 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMOTION P320-4S 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* As a prerequisite for an attack, an attacker must be able to run
untrusted code on affected systems. Siemens recommends limiting the
possibilities to run untrusted code if possible.
  
* Applying a Defense-in-Depth concept can help to reduce the probability
that untrusted code is run on the system. Siemens recommends to apply
the Defense-in-Depth concept: https://www.siemens.com/industrialsecurity
  


GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

SIMATIC Industrial PCs are the PC hardware platform for PC-based
Automation from Siemens.

SIMOTION is a scalable high performance hardware and software system for
motion control.

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS 
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be 
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2020-0543

  Incomplete cleanup from specific special register read operations in
  some Intel(R) Processors may allow an authenticated user to potentially
  enable information disclosure via local access.

  CVSS v3.1 Base Score: 5.5
  CVSS Vector:          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
  CWE:                  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor




ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and 
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2020-09-08): Publication Date
V1.1 (2020-10-13): Removed SINUMERIK 840D sl (NCU730.3B), SINUMERIK 828D (PPU.4 / PPU1740),
and SINUMERIK ONE (NCU1750 / NCU1760) from the list of affected
products. Added solution for SIMATIC IPC627E, SIMATIC IPC647E, SIMATIC
IPC677E, and SIMATIC IPC847E
V1.2 (2020-12-08): Added solution for SIMATIC IPC427E, SIMATIC IPC477E, and SIMATIC IPC477E
PRO
V1.3 (2021-02-09): Added solution for SIMATIC Field PG M5, and SIMATIC Field PG M6

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElTRCLAVwzKf/b8X80/SB6hFKr+QFAmAh0IAACgkQ0/SB6hFK
r+Rc+Q/8DiUpL8UTC7zI3bv7chMXPK8oQIouaQ7pZRi3SvxnDIDnnFpgeEWlmNNY
GJi87aDNfpSVmZ7i9UfnhO8jbiBaHkMPui8HarbSqk2YFxPmiWJ/Akpj3boJhPhE
VHUWQp/XE3LJ6CSXJ03/iSqXV9jJmkiUHNrSCh4W20oIJqUgxApVfDUOXm1+YWTB
F/nsX68GpkIhWAZT8oNaUgXi7v1HWCh0YUfWOwB8s8T/hcZPfGeFcT/tV2vlLvuD
GXGn1TdPQrtTdni65GT73CRjFv2mVdnKizp2Sn2Mm04TBy80cXsj6ezSOpi40ymd
y263YQ+YTkxi8A28Ue7Coho+agOyoBAIdBjiDShA+idfv1RPIJx6YXiS2s3SbcB0
9V4MkEeMBGRJBjFQ1iNCsBDegXkkkmOz9m1QlJLUXn6Ucrnv4UXOOgKpuzMBFDVZ
fzMvNlDb5pQPC4V7LUdiee/ii9BxhuAZYpYRhK7uxNR4N+ebCEcINEnnDNd/35Gy
VKbZlRNvmjlWM9En9/ljQlTgK+JTuzBxoB8JW7KCmMg5GJES6DVhFa8cfDTwzxiP
bdS5m88S3cuzvyGLjg+6RR6SftoxggP8oPb1ViX4v4bB0tY+Chfyiz6ZAVzdzdNs
oiIP1lCrKl9lrX6+Po3m17all1wjcuxTmxVNNkd+HjFVFU+y9Fo=
=V6bY
-----END PGP SIGNATURE-----