CVE-2010-2962

Priority
Medium
Description
drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in
the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in
the Linux kernel before 2.6.36 does not properly validate pointers to
blocks of memory, which allows local users to write to arbitrary kernel
memory locations, and consequently gain privileges, via crafted use of the
ioctl interface, related to (1) pwrite and (2) pread operations.
Ubuntu-Description
Kees Cook discovered that the Intel i915 graphics driver did not correctly
validate memory regions. A local attacker with access to the video card
could read and write arbitrary kernel memory to gain root privileges.
References
Notes
 kees> jaunty's code is a bit different, but at least half looks to still apply.
Assigned-to
ogasawara
Package
Upstream:released (2.6.36~rc7)
Package
Upstream:released (2.6.36~rc7)
Package
Upstream:released (2.6.36~rc7)
Package
Upstream:released (2.6.36~rc7)
Package
Source: linux (LP Ubuntu Debian)
Upstream:released (2.6.36~rc7)
Patches:
Upstream:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4
Upstream:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=7dcd2499deab8f10011713c40bc2f309c9b65077
Karmic:http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-2962/patches/karmic/linux/0001-drm-i915-Sanity-check-pread-pwrite.txt
Karmic:http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-2962/patches/karmic/linux/0002-drm-i915-Rephrase-pwrite-bounds-checking-to-avoid-any-.txt
Lucid:http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-2962/patches/lucid/linux/0001-drm-i915-Sanity-check-pread-pwrite.txt
Lucid:http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-2962/patches/lucid/linux/0002-drm-i915-Rephrase-pwrite-bounds-checking-to-avoid-any-.txt
Package
Upstream:released (2.6.36~rc7)
Package
Upstream:released (2.6.36~rc7)
More Information

Updated: 2018-06-26 04:37:19 UTC (commit 7799c934cca373482531a7b00e4dfe82302ceae5)