CVE-2024-27059 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
A malicious USB device can cause a kernel crash in the Linux isd200 driver by providing zero values for ATA heads or sectors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27059?
CVE-2024-27059 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer.
Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error).
Weakness: CWE-369
Which versions are affected by CVE-2024-27059?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-27059?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-27059 being exploited?
There is no known exploitation of CVE-2024-27059 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-55536, BELL-CVE-2024-27059, DEBIAN-CVE-2024-27059, GHSA-qpg3-72fq-2rqh, UBUNTU-CVE-2024-27059.