mx500 ssd CVE-2024-42642 (Buffer Overflow)

[Boombastik]

I found a site that says that, Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller.


-https://www.cve.org/CVERecord?id=CVE-2024-42642
-https://github.com/VL4DR/CVE-2024-42642/tree/main
-https://nvd.nist.gov/vuln/detail/CVE-2024-42642

I write it here for discussion.

 

[Mazer]

I wonder if this effects M3CR043 firmware? I have two of these drives one has 043 which is my game drive, the other one was the OS drive it does have M3CR046 firmware that I switched out since it was loosing health rather fast it's down to 94% since I bought it in February this year.

 

[hkpolice2]

Didn't this drive have excessive write amplification issues?

 

[Assimilator]

Crucial MX500 SSD Firmware M3CR046 Vulnerable to Buffer Overflow Attacks

One of the most popular SATA SSD brands, the Crucial MX500, has a vulnerability in its firmware version M3CR046. Apparently, specific ATA packets issued from the host can trigger a buffer overflow in the drive, cause data leaks. The vulnerability has been chronicled as CVE-2024-42642. At this...

www.techpowerup.com

 

[mb194dc]

Didn't this drive have excessive write amplification issues?

Yes on the earlier firmware and controller branch. Old thread on here somewhere for that.

What level of privilege do you need for this exploit?

 

[Hardcore Games]

Seems that SSD controller problems still have not been adequately ironed out yet

 

[SPDIF]

I wouldn't lose any sleep over it. Someone has to know in advance which brand and type of SSD you have, and then get into your PC and SSD without you noticing. The chance of that is virtually nil. They will not so much target a home user.
Crucial will probably be working on an update. They use various components and controllers for the same cheap drive and so they have many different firmware versions around. No idea if older SSD's are vulnerable and if Crucial will update them too.

The M3CR042 to M3CR045 firmware versions was known to let the the computer just hang up because the drive did not respond anymore after a very long time power on. The M3CR046 firmware fixed that problem. In their own words;

M3CR046 is an optional update which repairs a hang condition occurring under corner-case workloads. Most Windows desktop and notebook users will be unaffected by this change.