Description
In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9968c701cba7eda42e5f0052b040349d6222ae34affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < eb7b01ca778170654e1c76950024270ba74b121faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 284fb1003d5da111019b9e0bf99b084fd71ac133affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6c1f36d92c0a8799569055012665d2bb066fb964affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f42ba916689f5c7b1642092266d2f53cf527aaaaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 871fd7b10b56d280990b7e754f43d888382ca325affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3a67d4ab9e730361d183086dfb0ddd8c61f01636affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 014bcf41d946b36a8f0b8e9b5d9529efbb822f49affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.19.312 to ≤ 4.19.*unaffected5.4.274 to ≤ 5.4.*unaffected5.10.215 to ≤ 5.10.*unaffected5.15.154 to ≤ 5.15.*unaffected6.1.84 to ≤ 6.1.*unaffected6.6.24 to ≤ 6.6.*unaffected6.7.12 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9968c701cba7eda42e5f0052b040349d6222ae34 ↗
- https://git.kernel.org/stable/c/eb7b01ca778170654e1c76950024270ba74b121f ↗
- https://git.kernel.org/stable/c/284fb1003d5da111019b9e0bf99b084fd71ac133 ↗
- https://git.kernel.org/stable/c/6c1f36d92c0a8799569055012665d2bb066fb964 ↗
- https://git.kernel.org/stable/c/f42ba916689f5c7b1642092266d2f53cf527aaaa ↗
- https://git.kernel.org/stable/c/871fd7b10b56d280990b7e754f43d888382ca325 ↗
- https://git.kernel.org/stable/c/3a67d4ab9e730361d183086dfb0ddd8c61f01636 ↗
- https://git.kernel.org/stable/c/014bcf41d946b36a8f0b8e9b5d9529efbb822f49 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗