CVE - CVE-2024-27059

CVE-ID
CVE-2024-27059	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error).
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/014bcf41d946b36a8f0b8e9b5d9529efbb822f49 URL:https://git.kernel.org/stable/c/014bcf41d946b36a8f0b8e9b5d9529efbb822f49 MISC:https://git.kernel.org/stable/c/284fb1003d5da111019b9e0bf99b084fd71ac133 URL:https://git.kernel.org/stable/c/284fb1003d5da111019b9e0bf99b084fd71ac133 MISC:https://git.kernel.org/stable/c/3a67d4ab9e730361d183086dfb0ddd8c61f01636 URL:https://git.kernel.org/stable/c/3a67d4ab9e730361d183086dfb0ddd8c61f01636 MISC:https://git.kernel.org/stable/c/6c1f36d92c0a8799569055012665d2bb066fb964 URL:https://git.kernel.org/stable/c/6c1f36d92c0a8799569055012665d2bb066fb964 MISC:https://git.kernel.org/stable/c/871fd7b10b56d280990b7e754f43d888382ca325 URL:https://git.kernel.org/stable/c/871fd7b10b56d280990b7e754f43d888382ca325 MISC:https://git.kernel.org/stable/c/9968c701cba7eda42e5f0052b040349d6222ae34 URL:https://git.kernel.org/stable/c/9968c701cba7eda42e5f0052b040349d6222ae34 MISC:https://git.kernel.org/stable/c/eb7b01ca778170654e1c76950024270ba74b121f URL:https://git.kernel.org/stable/c/eb7b01ca778170654e1c76950024270ba74b121f MISC:https://git.kernel.org/stable/c/f42ba916689f5c7b1642092266d2f53cf527aaaa URL:https://git.kernel.org/stable/c/f42ba916689f5c7b1642092266d2f53cf527aaaa MLIST:[debian-lts-announce] 20240625 [SECURITY] [DLA 3842-1] linux-5.10 security update URL:https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html MLIST:[debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update URL:https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)