CVE-2010-2963

CVE-2010-2963 is a local privilege escalation vulnerability affecting the Video4Linux (V4L) implementation in the Linux kernel before version 2.6.36 on 64-bit platforms, impacting distributions like Canonical, Debian, Fedora, openSUSE, and SUSE. The flaw, residing in drivers/media/video/v4l2-compat-ioctl32.c, allows local users to write to arbitrary kernel memory due to a lack of destination validation during a memory copy operation. This is achieved through a specific sequence of VIDIOCSTUNER and VIDIOCSMICROCODE ioctl calls on a /dev/video device. With a CVSS score of 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C), this vulnerability has a high impact on confidentiality, integrity, and availability, but requires local access and high attack complexity. The FAUCET Risk Score is 81/100, indicating significant risk. While not listed on the CISA KEV catalog and with no known active exploitation, public exploit code (EDB-15344) exists, demonstrating the feasibility of exploitation. There is minimal community discussion or media coverage surrounding this CVE.