CVE-2024-42253 gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
A race condition in the Linux kernel PCA953x GPIO driver can cause incorrect register writes, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42253?
CVE-2024-42253 is a high-severity vulnerability in Linux kernel, published on 8 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
Ensure that `i2c_lock' is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races.
The other (non-probe) call site pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs().
The problem occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an i.MX8MP based system.
* Normal case
0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3
* Race case
0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0
Weakness: CWE-667
Which versions are affected by CVE-2024-42253?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-42253?
Apply the vendor's patch.
Is CVE-2024-42253 being exploited?
There is no known exploitation of CVE-2024-42253 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48811, BELL-CVE-2024-42253, DEBIAN-CVE-2024-42253, GHSA-gr3w-p7mm-8pcq, ROOT-OS-DEBIAN-11-CVE-2024-42253, ROOT-OS-UBUNTU-2204-CVE-2024-42253 and 1 more.