{"id":"CVE-2024-42253","state":"PUBLISHED","title":"gpio: pca953x: fix pca953x_irq_bus_sync_unlock race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock' is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0","publishedAt":"2024-08-08T08:46:29.284Z","updatedAt":"2026-08-05T11:36:05.727Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"58a5c93bd1a6e949267400080f07e57ffe05ec34","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"e2ecdddca80dd845df42376e4b0197fe97018ba2","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"de7cffa53149c7b48bd1bb29b02390c9f05b7f41","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"bfc6444b57dc7186b6acc964705d7516cbaf3904","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpio-pca953x.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"6.1.101","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.42","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.11","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpio-pca953x.c"]}],"references":["https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34","https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2","https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41","https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/42xxx/CVE-2024-42253.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42253","state":"PUBLISHED","datePublished":"2024-08-08T08:46:29.284Z","dateUpdated":"2026-08-05T11:36:05.727Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-30T07:40:12.256Z"},"containers":{"cna":{"title":"gpio: pca953x: fix pca953x_irq_bus_sync_unlock race","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock' is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"58a5c93bd1a6e949267400080f07e57ffe05ec34","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"e2ecdddca80dd845df42376e4b0197fe97018ba2","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"de7cffa53149c7b48bd1bb29b02390c9f05b7f41","versionType":"git"},{"version":"44896beae605b93f2232301befccb7ef42953198","status":"affected","lessThan":"bfc6444b57dc7186b6acc964705d7516cbaf3904","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpio-pca953x.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"6.1.101","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.42","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.11","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpio-pca953x.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34"},{"url":"https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2"},{"url":"https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41"},{"url":"https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable paths are reached only through local kernel interfaces — `/dev/gpiochipN` ioctls (`GPIO_V2_GET_LINE_IOCTL`, `GPIO_V2_LINE_SET_CONFIG_IOCTL`, `GPIO_V2_LINE_SET_VALUES_IOCTL`) or the legacy `/sys/class/gpio` attributes. No network or physical access is involved.\nAC:L - The attacker drives both sides of the race directly and without bound: one thread loops edge-detection setup/teardown to hit the unlocked `pca953x_irq_bus_sync_unlock()` writes while another loops value/bias writes that enter regmap under `i2c_lock`. The race occurred spontaneously ~1 in 1000 boots, so deliberate hammering wins it readily.\nPR:L - An open file descriptor on the GPIO chardev (or legacy sysfs GPIO attributes) is required; embedded, industrial and automotive distributions routinely grant these to a non-root `gpio` group via udev, so an ordinary unprivileged local user in the normal deployment for this driver qualifies.\nUI:N - The attacker performs every step itself via ioctls on its own file descriptors; no victim action, mount, or file open by another user is needed.\nS:U - The corruption is confined to kernel heap state and the I2C GPIO expander owned by the same kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With `.disable_locking = true`, the missing `i2c_lock` leaves the regmap register cache completely unserialized; `regcache_maple_write()`/`regcache_rbtree_write()` `kfree()`/`krealloc()` cache entries with no grace period while a concurrent walker still dereferences them, yielding a use-after-free read of kernel heap, and register reads return data from the wrong register.\nI:H - The commit documents interrupt-latch data being written into the expander's Output register, arbitrarily driving GPIO lines that gate power rails, resets and interlocks; additionally the unlocked cache path gives a use-after-free/double-free write primitive on the kernel heap.\nA:H - Concurrent unlocked mutation of the shared maple-tree/rbtree register cache with unsynchronized `kfree()` leads to double free and tree corruption — kernel oops or panic — and the expander can be left with interrupts wrongly latched or masked, wedging every GPIO consumer on the bus."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:36:05.727Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.9.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42253","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:13:09.580370Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:30.290Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:02:52.505Z"}}]}}}