CVE-2024-38619

What it actually does

Failure of alauda_init_media() leaves uzonesize at 0 in struct alauda_info, resulting in divide-by-zero in alauda_read_data() and alauda_write_lba() when the media is later accessed.

Why it matters to the business

Local users or attached USB devices can trigger kernel crashes on affected Linux systems, leading to denial of service and potential loss of availability for storage operations.

How an attack unfolds

An attacker with local access supplies a USB storage device that causes alauda_init_media() to fail. Subsequent read or write operations on the device trigger the unchecked divide-by-zero, crashing the kernel. No widespread in-the-wild exploitation or ransomware use has been observed.

How to fix it

Update the Linux kernel to the fixed commit e0aab7b07a9375337847c9d74a5ec044071e01c8 or later stable releases that include the media_initialized flag, first-initialization condition change, and alauda_init_media() error check.

How to confirm the fix worked

Confirm the running kernel contains commit e0aab7b07a9375337847c9d74a5ec044071e01c8; attempt to trigger alauda_init_media() failure paths in a test environment and verify no divide-by-zero occurs.

Typical attack path

1. Obtain local access to a Linux system with the alauda USB storage driver enabled
2. Attach or simulate a USB device that causes alauda_init_media() to return failure
3. Perform read or write operations that invoke alauda_read_data() or alauda_write_lba()
4. Trigger divide-by-zero resulting in kernel panic or oops

How to detect it

Review kernel logs for oops or panic messages mentioning alauda_init_media, alauda_read_data, or divide errors in the usb-storage alauda path; correlate with insertion of USB mass-storage devices around the crash time.

What your security team should do

• Apply the kernel update containing e0aab7b07a9375337847c9d74a5ec044071e01c8 as soon as possible on systems exposing the alauda driver
• Disable the alauda USB storage driver via kernel configuration if the hardware is not required
• Monitor for kernel oops or panic logs referencing alauda_read_data or alauda_write_lba