Subject: CVE-2024-38619: usb-storage: alauda: Check whether the media is initialized

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb-storage: alauda: Check whether the media is initialized

The member "uzonesize" of struct alauda_info will remain 0
if alauda_init_media() fails, potentially causing divide errors
in alauda_read_data() and alauda_write_lba().
- Add a member "media_initialized" to struct alauda_info.
- Change a condition in alauda_check_media() to ensure the
  first initialization.
- Add an error check for the return value of alauda_init_media().

The Linux kernel CVE team has assigned CVE-2024-38619 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 4.19.317 with commit e0aab7b07a93
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 5.4.279 with commit 51fe16c058ac
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 5.10.221 with commit f68820f1256b
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 5.15.162 with commit 3eee13ab67f6
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 6.1.95 with commit e0e2eec76920
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 6.6.35 with commit 2cc32639ec34
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 6.9.6 with commit 24bff7f714bd
	Issue introduced in 2.6.16 with commit e80b0fade09e and fixed in 6.10 with commit 16637fea001a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-38619
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/storage/alauda.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e0aab7b07a9375337847c9d74a5ec044071e01c8
	https://git.kernel.org/stable/c/51fe16c058acb22f847e69bc598066ed0bcd5c15
	https://git.kernel.org/stable/c/f68820f1256b21466ff094dd97f243b7e708f9c1
	https://git.kernel.org/stable/c/3eee13ab67f65606faa66e0c3c729e4f514838fd
	https://git.kernel.org/stable/c/e0e2eec76920a133dd49a4fbe4656d83596a1361
	https://git.kernel.org/stable/c/2cc32639ec347e3365075b130f9953ef16cb13f1
	https://git.kernel.org/stable/c/24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4
	https://git.kernel.org/stable/c/16637fea001ab3c8df528a8995b3211906165a30