PT-2010-4438 · Linux · Linux Kernel

Kees Cook · Published 2010-11-26 · Updated 2020-08-14 · CVE-2010-2963

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.36

Description The issue concerns a memory copy operation in the Video4Linux (V4L) implementation that does not validate the destination, allowing local users to write to arbitrary kernel memory locations and gain privileges. This can be achieved via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.

Recommendations For Linux kernel versions prior to 2.6.36, update to version 2.6.36 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-2963

DSA-2126-1

Affected Products

Linux Kernel

References · 16

• 🔥 https://exploit-db.com/exploits/15344 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=642465 · Exploit
• 🔥 http://outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2963 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:257 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1000-1 · Vendor Advisory
• http://debian.org/security/2010/dsa-2126 · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36 · Note
• http://securityfocus.com/bid/44242 · Note
• http://secunia.com/advisories/42745 · Note
• http://vupen.com/english/advisories/2010/3321 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3e645d6b485446c54c6745c5e2cf5c528fe4deec · Note