CVE-2010-2963

Linux Kernel <2.6.36 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-2963. PoCs published by Kees Cook.

AI-analyzed exploit summary This exploit leverages CVE-2010-2963 to perform arbitrary memory writes in the Linux kernel via the v4l1 compat ioctl interface. It manipulates the security_ops structure to escalate privileges by redirecting function pointers.

Description

drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Kees Cook · clocallinux
https://www.exploit-db.com/exploits/15344

This exploit leverages CVE-2010-2963 to perform arbitrary memory writes in the Linux kernel via the v4l1 compat ioctl interface. It manipulates the security_ops structure to escalate privileges by redirecting function pointers.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (versions affected by CVE-2010-2963)
No auth needed
Prerequisites: Access to /dev/video0 · Kernel with vulnerable v4l1 compat ioctl implementation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (14)

Core 14
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1000-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024710
Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3321
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:257
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/44242
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=642465
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42745
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2126

Scores

EPSS 0.0082
EPSS Percentile 52.1%

Details

CWE
CWE-20
Status published
Products (13)
canonical/ubuntu_linux 6.06
canonical/ubuntu_linux 8.04
canonical/ubuntu_linux 9.04
canonical/ubuntu_linux 9.10
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 10.10
debian/debian_linux 5.0
fedoraproject/fedora 13
linux/linux_kernel < 2.6.36
opensuse/opensuse 11.2
... and 3 more
Published Nov 26, 2010
Tracked Since Feb 18, 2026