CVE-2010-2963

Published: Nov 26, 2010Modified: Apr 29, 2026

6.2

Vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Exploitability: 1.9 / Impact: 10.0

Source: NVD

Description

drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.

Affected (13)

Products: Linux: Linux Kernel · Fedoraproject: Fedora · Opensuse: Opensuse · +3 more

Show all products

Linux: Linux Kernel · Fedoraproject: Fedora · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

2 products

Linux Enterprise Desktop

Linux Enterprise Server

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.36

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 13

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Suse Linux Enterprise Desktop	Version 11 sp1
Suse Linux Enterprise Server	Version 11 sp1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3e645d6b485446c54c6745c5e2cf5c528fe4deec

Source: security@ubuntu.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html

Source: security@ubuntu.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/42745

Source: security@ubuntu.com

Third Party Advisory

http://www.debian.org/security/2010/dsa-2126

Source: security@ubuntu.com

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

Source: security@ubuntu.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:257

Source: security@ubuntu.com

Third Party Advisory

http://www.outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/

Source: security@ubuntu.com

ExploitThird Party Advisory

http://www.securityfocus.com/bid/44242

Source: security@ubuntu.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024710

Source: security@ubuntu.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: security@ubuntu.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3321

Source: security@ubuntu.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=642465

Source: security@ubuntu.com

ExploitIssue TrackingPatchThird Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3e645d6b485446c54c6745c5e2cf5c528fe4deec

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://secunia.com/advisories/42745

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2010/dsa-2126

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:257

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://www.securityfocus.com/bid/44242

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024710

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3321

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=642465

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.