CVE-2010-2963

Published: 19 October 2010

drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.

From the Ubuntu security team

Kees Cook discovered that the V4L1 32bit compat interface did not correctly validate certain parameters. A local attacker on a 64bit system with access to a video device could exploit this to gain root privileges.

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	Upstream	Needs triage






	Patches: Hardy: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2963/patches/hardy/linux/0001-v4l-disable-dangerous-buggy-compat-function.txt Jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2963/patches/jaunty/linux/0001-v4l-disable-dangerous-buggy-compat-function.txt Karmic: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2963/patches/karmic/linux/0001-v4l-disable-dangerous-buggy-compat-function.txt Lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2963/patches/lucid/linux/0001-v4l-disable-dangerous-buggy-compat-function.txt Maverick: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2963/patches/maverick/linux/0001-v4l-disable-dangerous-buggy-compat-function.txt
linux-ec2 Launchpad, Ubuntu, Debian	Upstream	Needs triage






linux-fsl-imx51 Launchpad, Ubuntu, Debian	Upstream	Needs triage






linux-lts-backport-maverick Launchpad, Ubuntu, Debian	Upstream	Needs triage






linux-mvl-dove Launchpad, Ubuntu, Debian	Upstream	Needs triage






linux-source-2.6.15 Launchpad, Ubuntu, Debian	Upstream	Needs triage






linux-ti-omap4 Launchpad, Ubuntu, Debian	Upstream	Needs triage

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM