Description
drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny1 | DSA-2126-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux Kernel 2.6.36 - VIDIOCSMICROCODE IOCTL Local Memory Overwrite EDB-15344 · local · Oct 28, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2126-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1000-1 vendor-advisory
- 1024710 vdb-entry
- FEDORA-2010-18983 vendor-advisory
- ADV-2010-3321 vdb-entry
- http://www.outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/
- MDVSA-2010:257 vendor-advisory
- SUSE-SA:2010:057 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3e645d6b485446c54c6745c5e2cf5c528fe4deec
- 44242 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=642465
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- 42745 third-party-advisory
- SUSE-SA:2010:053 vendor-advisory
- DSA-2126 vendor-advisory