Bug 642469 - CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]
Summary: CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write [mrg-1.3]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: realtime-kernel
Version: Development
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: John Kacur
QA Contact: David Sommerseth
URL:
Whiteboard:
Depends On:
Blocks: CVE-2010-2963
TreeView+ depends on / blocked
 
Reported: 2010-10-13 02:30 UTC by Eugene Teo (Security Response)
Modified: 2016-05-22 23:31 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-08 19:10:41 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0958 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2010-12-08 19:08:55 UTC

Comment 1 Mauro Carvalho Chehab 2010-10-13 21:05:39 UTC 
The VIDIOCSMICROCODE is used only on this driver, and it requires some special program to upload a firmware, and a firmware blog. This one is enabled at MRG:

$ grep -i STRA MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt*
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rt.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtdebug.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rttrace.config:CONFIG_VIDEO_STRADIS=m
MRG/configs/kernel-2.6.33.7-rt29-mrg45-x86_64-rtvanilla.config:CONFIG_VIDEO_STRADIS=m

Do you have any user using it and/or any hardware for testing, and the firmware files/userspace program to work with?

We're removing this driver from kernel, as we couldn't find anyone using it upstream, and this is a really old driver, with several issues. Since the driver conversion from kernel 2.2 to 2.4, the driver author never updated it, so it became bit roted, with several issues.

IMHO, the better would be to simply disable this driver, and remove the compat stuff from v4l2-compat.
Comment 4 Eugene Teo (Security Response) 2010-10-15 01:51:03 UTC 
	$ grep MEDIA_SUPPORT /boot/config-2.6.33.7-rt29.44.el5rt 
	# CONFIG_MEDIA_SUPPORT is not set

	$ grep VIDEO_DEV /boot/config-2.6.33.7-rt29.44.el5rt 
	$

	$ grep CONFIG_VIDEO_STRADIS /boot/config-2.6.33.7-rt29.44.el5rt 
	$
Comment 5 Eugene Teo (Security Response) 2010-10-15 04:55:27 UTC 
I reopened this so that we can remove this piece of code like what the rhel-* kernels are (see mauro's patches in rhkernel-team-list).

Also see, https://bugzilla.redhat.com/show_bug.cgi?id=642465#c8. Thanks.
Comment 8 David Sommerseth 2010-12-06 20:41:33 UTC 
Verified by code review.

Found bz642469-CVE-2010-2963-v4l1-fix-32-bit-compat-microcode-loading-translation.patch (mrg-rt-v2.git d733bc99f8b6ff7aa3a9e9c24cfead3f1e068e6a / upstream 3e645d6b485446c54c6745c5e2cf5c528fe4deec) applied to kernel-rt-2.6.33.7-rt29.47.src.rpm.
Comment 10 errata-xmlrpc 2010-12-08 19:10:41 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2010-0958.html
Note You need to log in before you can comment on or make changes to this bug.