In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953xirqbussyncunlock race
Ensure that `i2clock' is held when setting interrupt latch and mask in pca953xirqbussync_unlock() in order to avoid races.
The other (non-probe) call site pca953xgpiosetmultiple() ensures the lock is held before calling pca953xwrite_regs().
The problem occurred when a request raced against irqbussync_unlock() approximately once per thousand reboots on an i.MX8MP based system.
Normal case
0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3
Race case
0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} * Wrong register * 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpio/gpio-pca953x.c", "function": "pca953x_irq_bus_sync_unlock" }, "id": "CVE-2024-42253-55873739", "digest": { "length": 801.0, "function_hash": "249745683070855020683425430195901703342" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de7cffa53149c7b48bd1bb29b02390c9f05b7f41" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpio/gpio-pca953x.c" }, "id": "CVE-2024-42253-858888a2", "digest": { "line_hashes": [ "17159308184472723571644457384767130875", "119831216954862763951921803380321661409", "231333424026256166548214216876353286623", "31809566084848239675685643491664984296" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de7cffa53149c7b48bd1bb29b02390c9f05b7f41" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpio/gpio-pca953x.c" }, "id": "CVE-2024-42253-b6a8506f", "digest": { "line_hashes": [ "17159308184472723571644457384767130875", "119831216954862763951921803380321661409", "231333424026256166548214216876353286623", "31809566084848239675685643491664984296" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2ecdddca80dd845df42376e4b0197fe97018ba2" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpio/gpio-pca953x.c", "function": "pca953x_irq_bus_sync_unlock" }, "id": "CVE-2024-42253-c83e96ac", "digest": { "length": 801.0, "function_hash": "249745683070855020683425430195901703342" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2ecdddca80dd845df42376e4b0197fe97018ba2" } ] }