227 lines
12 KiB
JSON
227 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-42253",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-07-30T07:40:12.256Z",
|
|
"datePublished": "2024-08-08T08:46:29.284Z",
|
|
"dateUpdated": "2026-08-05T11:36:05.727Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:36:05.727Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock' is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n 0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n 0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n 0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n 0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable paths are reached only through local kernel interfaces — `/dev/gpiochipN` ioctls (`GPIO_V2_GET_LINE_IOCTL`, `GPIO_V2_LINE_SET_CONFIG_IOCTL`, `GPIO_V2_LINE_SET_VALUES_IOCTL`) or the legacy `/sys/class/gpio` attributes. No network or physical access is involved.\nAC:L - The attacker drives both sides of the race directly and without bound: one thread loops edge-detection setup/teardown to hit the unlocked `pca953x_irq_bus_sync_unlock()` writes while another loops value/bias writes that enter regmap under `i2c_lock`. The race occurred spontaneously ~1 in 1000 boots, so deliberate hammering wins it readily.\nPR:L - An open file descriptor on the GPIO chardev (or legacy sysfs GPIO attributes) is required; embedded, industrial and automotive distributions routinely grant these to a non-root `gpio` group via udev, so an ordinary unprivileged local user in the normal deployment for this driver qualifies.\nUI:N - The attacker performs every step itself via ioctls on its own file descriptors; no victim action, mount, or file open by another user is needed.\nS:U - The corruption is confined to kernel heap state and the I2C GPIO expander owned by the same kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With `.disable_locking = true`, the missing `i2c_lock` leaves the regmap register cache completely unserialized; `regcache_maple_write()`/`regcache_rbtree_write()` `kfree()`/`krealloc()` cache entries with no grace period while a concurrent walker still dereferences them, yielding a use-after-free read of kernel heap, and register reads return data from the wrong register.\nI:H - The commit documents interrupt-latch data being written into the expander's Output register, arbitrarily driving GPIO lines that gate power rails, resets and interlocks; additionally the unlocked cache path gives a use-after-free/double-free write primitive on the kernel heap.\nA:H - Concurrent unlocked mutation of the shared maple-tree/rbtree register cache with unsynchronized `kfree()` leads to double free and tree corruption — kernel oops or panic — and the expander can be left with interrupts wrongly latched or masked, wedging every GPIO consumer on the bus."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpio/gpio-pca953x.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "44896beae605b93f2232301befccb7ef42953198",
|
|
"lessThan": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "44896beae605b93f2232301befccb7ef42953198",
|
|
"lessThan": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "44896beae605b93f2232301befccb7ef42953198",
|
|
"lessThan": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "44896beae605b93f2232301befccb7ef42953198",
|
|
"lessThan": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpio/gpio-pca953x.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.7",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.101",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.42",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.9.11",
|
|
"lessThanOrEqual": "6.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.7",
|
|
"versionEndExcluding": "6.1.101"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.7",
|
|
"versionEndExcluding": "6.6.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.7",
|
|
"versionEndExcluding": "6.9.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.7",
|
|
"versionEndExcluding": "6.10"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904"
|
|
}
|
|
],
|
|
"title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock race",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-42253",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2024-09-10T16:13:09.580370Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-11T17:34:30.290Z"
|
|
}
|
|
},
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T22:02:52.505Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |