Security readout for executives and security teams
Plain-English summary
A race condition in the Linux PCA953x GPIO expander driver can write interrupt configuration data to the wrong hardware register. The reported failure was intermittent—about once per thousand reboots on an i.MX8MP system—but incorrect GPIO behavior may affect confidentiality, integrity, or availability where these signals control sensitive hardware functions.
Executive priority
Treat as a high-priority maintenance issue for embedded, industrial, appliance, or edge systems using affected GPIO hardware, especially where GPIO outputs influence safety, access, power, or service availability. Broad enterprise Linux exposure is less likely without the relevant device. Patch during the next controlled maintenance window, accelerating for critical hardware roles.
Technical view
pca953x_irq_bus_sync_unlock() updated interrupt latch and mask registers without holding i2c_lock. A concurrent request could interfere with register selection, causing data intended for the input-latch register to reach an output register. The upstream correction holds the lock during these writes. The supplied CVSS v3.1 score is 7.8 with local, low-complexity, low-privilege access.
Likely exposure
Exposure is limited to Linux systems using the PCA953x GPIO expander driver in configurations where interrupt synchronization can race with concurrent GPIO operations. The source confirms occurrence on an i.MX8MP-based system. The supplied version data marks Linux 4.7 through several later release lines as affected, but exact distribution package boundaries require vendor confirmation.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit. Evidence describes a rare operational race observed during reboot, not a demonstrated attack. The CVSS vector nevertheless indicates that a local, low-privileged attacker may be able to trigger high-impact consequences.
Researcher notes
The defect is a missing I2C lock around interrupt latch and mask writes in pca953x_irq_bus_sync_unlock(). The source shows register-pointer corruption during a concurrent request. Reproduction frequency and impact are hardware and workload dependent. The bundle does not establish exact vulnerable configurations, exploit reliability, or per-distribution fixed versions.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced upstream locking fix.
- Consult the operating-system or appliance vendor for the exact fixed package version.
- Prioritize systems where PCA953x GPIO signals control security-sensitive or availability-critical hardware.
- Limit local access and unnecessary privileged device interfaces until affected systems are updated.
Validation and detection
- Inventory kernel versions and identify systems loading or incorporating the PCA953x GPIO driver.
- Confirm whether affected hardware includes PCA953x-compatible GPIO expanders and interrupt handling.
- Verify the installed kernel includes the applicable referenced stable commit or vendor backport.
- Review vendor advisories and package changelogs for explicit CVE-2024-42253 remediation.
- After updating, exercise reboot and GPIO-dependent health checks for device-specific regressions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42253 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/58a5c93bd1a6e949267400080f07e57ffe05ec34CVE reference, Linux
- https://git.kernel.org/stable/c/e2ecdddca80dd845df42376e4b0197fe97018ba2CVE reference, Linux
- https://git.kernel.org/stable/c/de7cffa53149c7b48bd1bb29b02390c9f05b7f41CVE reference, Linux
- https://git.kernel.org/stable/c/bfc6444b57dc7186b6acc964705d7516cbaf3904CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.