CVE-2010-2963: Input Validation
drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.
Other sources
The ioctl32 v4l1 compat code for VIDIOCSMICROCODE does not check the destination buffer for a copyfromuser() call, which allows anyone with access to a v4l device to write to arbitrary kernel memory locations. This allocates the memory and uses a compat pointer for the copy.
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2963?
CVE-2010-2963 is considered a high severity vulnerability due to its potential to allow local users to gain elevated privileges in the Linux kernel.
How do I fix CVE-2010-2963?
To fix CVE-2010-2963, update your Linux kernel to version 2.6.36 or later.
Which Linux distributions are affected by CVE-2010-2963?
CVE-2010-2963 affects several distributions including Debian, Fedora, openSUSE, and Ubuntu versions prior to their respective patches.
What types of attacks can CVE-2010-2963 enable?
CVE-2010-2963 can enable local users to write to arbitrary kernel memory locations, potentially leading to privilege escalation.
Is there a common exploit method for CVE-2010-2963?
Common exploit methods for CVE-2010-2963 involve leveraging the vulnerability in the Video4Linux implementation to execute arbitrary code in the kernel.