CVE-2024-27059

A flaw was found in the Linux kernel's USB storage driver. When processing identification data for ISD200 devices, the driver does not verify that reported sector and head counts are greater than zero before performing division operations. A local attacker who connects a specially crafted or emulated USB storage device can trigger a divide-by-zero error, causing a kernel crash and resulting in a Denial of Service (DoS).

This vulnerability is rated with a Low severity because exploitation requires physical access to plug in a malicious hardware device or the ability to attach an emulated USB device to a virtualized guest. The flaw is restricted to the handling of legacy ISD200 ATA bridge hardware in the USB storage subsystem, an uncommon hardware profile in standard enterprise environments. While triggering the flaw crashes the kernel and results in a denial of service, it cannot be leveraged for arbitrary code execution, privilege escalation, or data disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.