CVE-2024-42253 (GCVE-0-2024-42253)
Vulnerability from cvelistv5
Published
2024-08-08 08:46
Modified
2026-08-05 11:36
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races. The other (non-probe) call site pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs(). The problem occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an i.MX8MP based system. * Normal case 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 * Race case 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0
References
Impacted products
Vendor Product Version
Linux Linux Version: 44896beae605b93f2232301befccb7ef42953198
Version: 44896beae605b93f2232301befccb7ef42953198
Version: 44896beae605b93f2232301befccb7ef42953198
Version: 44896beae605b93f2232301befccb7ef42953198
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42253",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:09.580370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:30.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:02:52.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-pca953x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
              "status": "affected",
              "version": "44896beae605b93f2232301befccb7ef42953198",
              "versionType": "git"
            },
            {
              "lessThan": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
              "status": "affected",
              "version": "44896beae605b93f2232301befccb7ef42953198",
              "versionType": "git"
            },
            {
              "lessThan": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
              "status": "affected",
              "version": "44896beae605b93f2232301befccb7ef42953198",
              "versionType": "git"
            },
            {
              "lessThan": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
              "status": "affected",
              "version": "44896beae605b93f2232301befccb7ef42953198",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-pca953x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.101",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.42",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.11",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock\u0027 is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are reached only through local kernel interfaces \u2014 `/dev/gpiochipN` ioctls (`GPIO_V2_GET_LINE_IOCTL`, `GPIO_V2_LINE_SET_CONFIG_IOCTL`, `GPIO_V2_LINE_SET_VALUES_IOCTL`) or the legacy `/sys/class/gpio` attributes. No network or physical access is involved.\nAC:L - The attacker drives both sides of the race directly and without bound: one thread loops edge-detection setup/teardown to hit the unlocked `pca953x_irq_bus_sync_unlock()` writes while another loops value/bias writes that enter regmap under `i2c_lock`. The race occurred spontaneously ~1 in 1000 boots, so deliberate hammering wins it readily.\nPR:L - An open file descriptor on the GPIO chardev (or legacy sysfs GPIO attributes) is required; embedded, industrial and automotive distributions routinely grant these to a non-root `gpio` group via udev, so an ordinary unprivileged local user in the normal deployment for this driver qualifies.\nUI:N - The attacker performs every step itself via ioctls on its own file descriptors; no victim action, mount, or file open by another user is needed.\nS:U - The corruption is confined to kernel heap state and the I2C GPIO expander owned by the same kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With `.disable_locking = true`, the missing `i2c_lock` leaves the regmap register cache completely unserialized; `regcache_maple_write()`/`regcache_rbtree_write()` `kfree()`/`krealloc()` cache entries with no grace period while a concurrent walker still dereferences them, yielding a use-after-free read of kernel heap, and register reads return data from the wrong register.\nI:H - The commit documents interrupt-latch data being written into the expander\u0027s Output register, arbitrarily driving GPIO lines that gate power rails, resets and interlocks; additionally the unlocked cache path gives a use-after-free/double-free write primitive on the kernel heap.\nA:H - Concurrent unlocked mutation of the shared maple-tree/rbtree register cache with unsynchronized `kfree()` leads to double free and tree corruption \u2014 kernel oops or panic \u2014 and the expander can be left with interrupts wrongly latched or masked, wedging every GPIO consumer on the bus."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:05.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2"
        },
        {
          "url": "https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904"
        }
      ],
      "title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42253",
    "datePublished": "2024-08-08T08:46:29.284Z",
    "dateReserved": "2024-07-30T07:40:12.256Z",
    "dateUpdated": "2026-08-05T11:36:05.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:02:52.505Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42253\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:13:09.580370Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.064Z\"}}], \"cna\": {\"title\": \"gpio: pca953x: fix pca953x_irq_bus_sync_unlock race\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"44896beae605b93f2232301befccb7ef42953198\", \"lessThan\": \"58a5c93bd1a6e949267400080f07e57ffe05ec34\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44896beae605b93f2232301befccb7ef42953198\", \"lessThan\": \"e2ecdddca80dd845df42376e4b0197fe97018ba2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44896beae605b93f2232301befccb7ef42953198\", \"lessThan\": \"de7cffa53149c7b48bd1bb29b02390c9f05b7f41\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44896beae605b93f2232301befccb7ef42953198\", \"lessThan\": \"bfc6444b57dc7186b6acc964705d7516cbaf3904\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpio/gpio-pca953x.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpio/gpio-pca953x.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34\"}, {\"url\": \"https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2\"}, {\"url\": \"https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41\"}, {\"url\": \"https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\\n\\nEnsure that `i2c_lock\u0027 is held when setting interrupt latch and mask in\\npca953x_irq_bus_sync_unlock() in order to avoid races.\\n\\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\\nlock is held before calling pca953x_write_regs().\\n\\nThe problem occurred when a request raced against irq_bus_sync_unlock()\\napproximately once per thousand reboots on an i.MX8MP based system.\\n\\n * Normal case\\n\\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\\n\\n * Race case\\n\\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.101\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.42\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.11\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:52:08.494Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42253\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:52:08.494Z\", \"dateReserved\": \"2024-07-30T07:40:12.256Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-08T08:46:29.284Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.