CVE-2024-42136

What it actually does

Signed integer underflow in cdrom last_media_change arithmetic check in drivers/cdrom/cdrom.c:2361 allowing values that cannot be represented in __s64, triggering UBSAN.

Why it matters to the business

Kernel instability or crashes on Linux systems with CD-ROM or optical drives when certain deprecated SCSI ioctls are used, increasing operational risk on servers or embedded devices still exposing block device interfaces.

How an attack unfolds

An attacker with local access invokes cdrom or sr_block_ioctl with crafted parameters that reach the last_media_change subtraction, causing the sanitizer-detected overflow; listed espionage and financially motivated actors have targeted similar Linux kernel memory issues in zero-day campaigns.

How to fix it

Upgrade the Linux kernel to the commit 0c97527e916054acc4a46ffb02842988acb2e92b or later stable releases that rearrange the check to avoid arithmetic.

How to confirm the fix worked

Confirm kernel source contains the rearranged last_media_change check without subtraction, rebuild, boot, and verify no UBSAN splat occurs under syzkaller or equivalent ioctl fuzzing.

Typical attack path

1. Obtain local user or process execution on target Linux system
2. Open block device or CD-ROM character device
3. Issue deprecated SCSI ioctl or cdrom_ioctl triggering media change timestamp check
4. Supply values producing underflow in signed 64-bit subtraction
5. Trigger UBSAN handler or resulting undefined behavior

How to detect it

Search kernel logs and dmesg for UBSAN signed-integer-overflow messages referencing cdrom.c:2361 or cdrom_ioctl; correlate with process names invoking sr_block_ioctl or blkdev_ioctl.

• UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33
• -9223372036854775808 - 346321 cannot be represented in type '__s64'
• program syz-executor.* is using a deprecated SCSI ioctl, please convert it to SG_IO
• cdrom_ioctl+0x2c3f/0x2d10

What your security team should do

• Prioritize kernel updates on all systems exposing optical or block devices within 30 days
• Disable or restrict legacy SCSI/CDROM ioctls via kernel config or seccomp where possible
• Monitor for UBSAN reports in production kernels with the sanitizer enabled
• Review downstream distributions for backported fixes matching commit 0c97527e