CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953xirqbussyncunlock race
Ensure that i2clock' is held when setting interrupt latch and mask in pca953xirqbussyncunlock() in order to avoid races.
The other (non-probe) call site pca953xgpiosetmultiple() ensures the lock is held before calling pca953xwriteregs().
The problem occurred when a request raced against irqbussyncunlock() approximately once per thousand reboots on an i.MX8MP based system.
Normal case
0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3
Race case
0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} Wrong register 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Ensure that `i2c_lock` is held when setting interrupt latch and mask in `pca953x_irq_bus_sync_unlock()` to avoid races (gpio: pca953x: fix pca953x_irq_bus_sync_unlock race).
Linux kernel gpio: pca953x i2c_lock held during pca953x_irq_bus_sync_unlock() while setting interrupt latch and mask = true
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42253?
CVE-2024-42253 is classified as a moderate severity vulnerability due to potential race conditions in the Linux kernel.
How do I fix CVE-2024-42253?
To fix CVE-2024-42253, users should update to the remedied versions of the Linux kernel as specified in the advisory.
What software is affected by CVE-2024-42253?
CVE-2024-42253 affects various versions of the Linux kernel, including versions up to 6.1.101 and from 6.2 to 6.6.42.
What specific versions should I upgrade to regarding CVE-2024-42253?
Users should upgrade to Linux kernel versions such as 6.1.123-1, 6.1.119-1, or other specified remedied versions to address CVE-2024-42253.
What are the potential impacts of CVE-2024-42253?
CVE-2024-42253 can lead to instability and unpredictable behavior in systems relying on the affected Linux kernel versions due to race conditions.