Bug 642469

Summary: CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]
Product: Red Hat Enterprise MRG Reporter: Eugene Teo (Security Response) <eteo>
Component: realtime-kernelAssignee: John Kacur <jkacur>
Status: CLOSED ERRATA QA Contact: David Sommerseth <davids>
Severity: medium Docs Contact:
Priority: medium    
Version: DevelopmentCC: acme, bhu, jkacur, lgoncalv, mchehab, ovasik, plyons, security-response-team, williams
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-12-08 19:10:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 642465    

Comment 1 Mauro Carvalho Chehab 2010-10-13 21:05:39 UTC 
The VIDIOCSMICROCODE is used only on this driver, and it requires some special program to upload a firmware, and a firmware blog. This one is enabled at MRG:

$ grep -i STRA MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt*
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtdebug.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rttrace.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtvanilla.config:CONFIG_VIDEO_STRADIS=m

Do you have any user using it and/or any hardware for testing, and the firmware files/userspace program to work with?

We're removing this driver from kernel, as we couldn't find anyone using it upstream, and this is a really old driver, with several issues. Since the driver conversion from kernel 2.2 to 2.4, the driver author never updated it, so it became bit roted, with several issues.

IMHO, the better would be to simply disable this driver, and remove the compat stuff from v4l2-compat.
Comment 4 Eugene Teo (Security Response) 2010-10-15 01:51:03 UTC 
	$ grep MEDIA_SUPPORT /boot/config-2.6.33.7-rt29.44.el5rt 
	# CONFIG_MEDIA_SUPPORT is not set

	$ grep VIDEO_DEV /boot/config-2.6.33.7-rt29.44.el5rt 
	$

	$ grep CONFIG_VIDEO_STRADIS /boot/config-2.6.33.7-rt29.44.el5rt 
	$
Comment 5 Eugene Teo (Security Response) 2010-10-15 04:55:27 UTC 
I reopened this so that we can remove this piece of code like what the rhel-* kernels are (see mauro's patches in rhkernel-team-list).

Also see, https://bugzilla.redhat.com/show_bug.cgi?id=642465#c8. Thanks.
Comment 8 David Sommerseth 2010-12-06 20:41:33 UTC 
Verified by code review.

Found bz642469-CVE-2010-2963-v4l1-fix-32-bit-compat-microcode-loading-translation.patch (mrg-rt-v2.git d733bc99f8b6ff7aa3a9e9c24cfead3f1e068e6a / upstream 3e645d6b485446c54c6745c5e2cf5c528fe4deec) applied to kernel-rt-2.6.33.7-rt29.47.src.rpm.
Comment 10 errata-xmlrpc 2010-12-08 19:10:41 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2010-0958.html