CVE-2010-2962: Input Validation
Description of problem: Kees found a flaw in the i915 GEM ioctl interface that does not check destination addresses during memory copies, allowing arbitrary memory writes into the kernel. The flaws are in drivers/gpu/drm/i915/i915gem.c in i915gempreadioctl() and i915gempwriteioctl(), which do no accessok() checks on args->dataptr. (Actually, there is one check path: i915gemgttpwritefast() does the check, but none of the other helpers do.).
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
Other sources
drivers/gpu/drm/i915/i915gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2962?
CVE-2010-2962 is classified as a high severity vulnerability due to its potential for arbitrary memory writes into the kernel.
How do I fix CVE-2010-2962?
Fixing CVE-2010-2962 involves updating to a Linux kernel version later than 2.6.36 which includes the necessary patches.
Which systems are affected by CVE-2010-2962?
CVE-2010-2962 affects multiple Linux distributions, including Debian, Fedora, openSUSE, and various versions of Ubuntu.
What types of attacks can exploit CVE-2010-2962?
Exploitation of CVE-2010-2962 can lead to privilege escalation and the potential execution of arbitrary code within the kernel.
What are the main code components involved in CVE-2010-2962?
The vulnerability arises from flaws in the i915 GEM ioctl interface, specifically in the i915_gem_pread_ioctl() and i915_gem_pwrite_ioctl() functions.