CVE-2024-27059: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
In the Linux kernel, the following vulnerability has been resolved:
USB: usb-storage: Prevent divide-by-0 error in isd200atacommand
The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer.
Protect against this possibility by refusing to bind to the device if either the ATAIDHEADS or ATAIDSECTORS value in the device's ID information is 0. This requires isd200Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error).
Other sources
In the Linux kernel, the following vulnerability has been resolved:
USB: usb-storage: Prevent divide-by-0 error in isd200atacommand
The Linux kernel CVE team has assigned CVE-2024-27059 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-27059-baaa@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.312 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.274 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.215 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.84 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Compensating control
In the isd200 usb-storage sub-driver, refuse to bind to a device when either ATA_ID_HEADS or ATA_ID_SECTORS in its ATA ID information is 0, and make isd200_Initialization() return a negative error code when initialization fails.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27059?
CVE-2024-27059 is considered a medium severity vulnerability due to its potential to cause a divide-by-zero error in the Linux kernel.
How do I fix CVE-2024-27059?
To fix CVE-2024-27059, update the Linux kernel to versions 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, or 6.8.
Which Linux kernel versions are affected by CVE-2024-27059?
CVE-2024-27059 affects Linux kernel versions prior to 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, and 6.8.
What component is impacted by CVE-2024-27059?
CVE-2024-27059 impacts the USB usb-storage component of the Linux kernel.
Is there a workaround for CVE-2024-27059?
There are no known workarounds for CVE-2024-27059; patching to the recommended kernel versions is advised.