Bug 642469 – CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 642469 - CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]

Summary:	CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise MRG
Classification:	Red Hat
Component:	realtime-kernel (Show other bugs)
Sub Component:
Version:	Development
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	John Kacur
QA Contact:	David Sommerseth
Docs Contact:

URL:
Whiteboard:
Keywords:	Reopened, Security

Depends On:
Blocks:	CVE-2010-2963
	Show dependency tree / graph

Reported:	2010-10-12 22:30 EDT by Eugene Teo (Security Response)
Modified:	2016-05-22 19:31 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-12-08 14:10:41 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2010:0958	normal	SHIPPED_LIVE	Important: kernel-rt security and bug fix update	2010-12-08 14:08:55 EST

Groups: None (edit)

Comment 1 Mauro Carvalho Chehab 2010-10-13 17:05:39 EDT

The VIDIOCSMICROCODE is used only on this driver, and it requires some special program to upload a firmware, and a firmware blog. This one is enabled at MRG:

$ grep -i STRA MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt*
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtdebug.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rttrace.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtvanilla.config:CONFIG_VIDEO_STRADIS=m

Do you have any user using it and/or any hardware for testing, and the firmware files/userspace program to work with?

We're removing this driver from kernel, as we couldn't find anyone using it upstream, and this is a really old driver, with several issues. Since the driver conversion from kernel 2.2 to 2.4, the driver author never updated it, so it became bit roted, with several issues.

IMHO, the better would be to simply disable this driver, and remove the compat stuff from v4l2-compat.

Comment 4 Eugene Teo (Security Response) 2010-10-14 21:51:03 EDT

	$ grep MEDIA_SUPPORT /boot/config-2.6.33.7-rt29.44.el5rt 
	# CONFIG_MEDIA_SUPPORT is not set

	$ grep VIDEO_DEV /boot/config-2.6.33.7-rt29.44.el5rt 
	$

	$ grep CONFIG_VIDEO_STRADIS /boot/config-2.6.33.7-rt29.44.el5rt 
	$

Comment 5 Eugene Teo (Security Response) 2010-10-15 00:55:27 EDT

I reopened this so that we can remove this piece of code like what the rhel-* kernels are (see mauro's patches in rhkernel-team-list).

Also see, https://bugzilla.redhat.com/show_bug.cgi?id=642465#c8. Thanks.

Comment 8 David Sommerseth 2010-12-06 15:41:33 EST

Verified by code review.

Found bz642469-CVE-2010-2963-v4l1-fix-32-bit-compat-microcode-loading-translation.patch (mrg-rt-v2.git d733bc99f8b6ff7aa3a9e9c24cfead3f1e068e6a / upstream 3e645d6b485446c54c6745c5e2cf5c528fe4deec) applied to kernel-rt-2.6.33.7-rt29.47.src.rpm.

Comment 10 errata-xmlrpc 2010-12-08 14:10:41 EST

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2010-0958.html

Note You need to log in before you can comment on or make changes to this bug.