CVE-2024-47682

What it actually does

Off-by-one error in sd_read_block_characteristics() allows out-of-bounds memory access to the zoned field at offset 8 when page 0xb1 returns with length 8.

Why it matters to the business

Potential kernel memory corruption or crashes on Linux systems using SCSI devices; widespread impact due to Linux kernel prevalence in servers and infrastructure.

How an attack unfolds

Attacker supplies a crafted SCSI device response triggering the OOB access during device initialization; observed in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Linux Kernel Out-of-Bounds Access Vulnerability campaigns.

How to fix it

Upgrade affected Puma (RubyGems) packages to 4.3.3 or 3.12.4; apply Linux kernel patch resolving the off-by-one error in sd.c.

How to confirm the fix worked

Verify kernel version contains the fix for sd_read_block_characteristics(); confirm SCSI device page 0xb1 handling no longer performs out-of-bounds access.

Typical attack path

1. Present malicious or emulated SCSI device returning short page 0xb1 response
2. Trigger sd_read_block_characteristics() during kernel device probe
3. Cause out-of-bounds read/write on zoned field
4. Leverage memory corruption for denial of service or further exploitation

How to detect it

Inspect kernel logs for sd driver errors or oops during device enumeration; look for patterns matching Linux Kernel Out-of-Bounds Read/Write/Access Vulnerability activity by listed threat actors.

What your security team should do

• Prioritize patching Linux kernels on systems with SCSI/zoned block devices
• Monitor for device initialization anomalies in kernel logs
• Restrict untrusted SCSI device attachment where possible