CVE-2024-27059

What it actually does

Division by zero in isd200_ata_command when ATA_ID_HEADS or ATA_ID_SECTORS is zero, causing kernel crash on device bind.

Why it matters to the business

Local denial of service that can crash systems when a specially crafted or emulated USB storage device is attached, disrupting operations until reboot.

How an attack unfolds

An attacker with physical or local access supplies a USB device whose ATA IDENTIFY data reports zero heads or sectors; usb-storage binds to it, isd200_Initialization proceeds, and the subsequent division in isd200_ata_command triggers a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 9968c701cba7eda42e5f0052b040349d6222ae34 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 9968c701cba7eda42e5f0052b040349d6222ae34; attempt to attach a test device reporting zero heads/sectors and confirm the driver refuses to bind instead of crashing.

Typical attack path

1. Obtain or emulate a USB mass-storage device that returns ATA_ID_HEADS=0 or ATA_ID_SECTORS=0
2. Attach the device to a vulnerable Linux system
3. Kernel usb-storage driver binds and calls isd200_Initialization
4. Division-by-zero occurs during CDB construction for READ/WRITE
5. Kernel oops/panic results in denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing isd200, usb-storage, or divide error around the time of USB device insertion.

• kernel: divide error: 0000 [#1] SMP
• isd200_ata_command
• usb-storage: device scan failed

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems exposing USB storage
• Restrict untrusted USB devices via USBGuard or kernel module blacklisting where feasible
• Monitor for kernel oops involving isd200 or usb-storage after any USB insertion