Home/CVE/drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering
CVE
↯ PDF report

CVE-2010-2962

drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering

drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.

HIGH · CVSS 7.2 EPSS 0.00483
EPSS exploitation odds0.48% · top 61%
Schedule remediation
  • CVSS base score ≥ 7.0
No Sigma yet — build one → YARA rules0
Look this up elsewhere - one-click external pivots
NVDCVE.orgCISAExploit-DBGitHub PoCVulnCheck KEVGreyNoise
▸ How to read a CVE - triage first, then detect and patch
This page is every public fact about CVE-2010-2962, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.
Triage: should I act now? Four signals, and they are not interchangeable:
CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.
How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.
Then what - two workflows:
Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.
Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).
▣

Severity & exploitation scoring

CVSS base score
7.2
HIGHCVSS v3.1 · [email protected]
EPSS exploitation probability
0.48%
Top 61%odds of exploitation in the next 30 days
CVSS metric silhouette
No structured CVSS vector for this CVE. Older entries often have only a numeric base score - the metric breakdown radar requires a full AV:_/AC:_/... vector string published by NVD.
SSVC triage
No SSVC vulnrichment for this CVE. CISA's Vulnrichment program scores newer CVEs (~2024 onwards) plus selected older critical ones. Use the EPSS probability + KEV status to triage instead.
Lifecycle
  1. 26 Nov 2010Published to NVD
  2. 16 Jun 2026Last modified
Every entry is a recorded date - NVD publish/modify, CISA KEV add, public exploit disclosure. No inferred events.
Attack path
Full kill chain
→
◆

ATT&CK techniques

1

Techniques this CVE enables. Pills with a solid outline are high confidence - named directly in ATT&CK or Nuclei, or human-curated by CTID; the rest are inferred from the weakness type using MITRE's CVE Mapping Methodology and the CWE → CAPEC chain. Broad, generic-weakness guesses are filtered out. A small N× marks a technique that N independent sources agree on.

T1203 · Exploitation for Client Execution
▤ Build a SIEM detection for these techniques
▤

CAPEC attack patterns

12

Attack patterns this CVE enables - the bridge from weakness to ATT&CK technique.

CAPEC-CAPEC-10 · Buffer Overflow via Environment Variables CAPEC-CAPEC-101 · Server Side Include (SSI) Injection CAPEC-CAPEC-104 · Cross Zone Scripting CAPEC-CAPEC-108 · Command Line Execution through SQL Injection CAPEC-CAPEC-109 · Object Relational Mapping Injection CAPEC-CAPEC-110 · SQL Injection through SOAP Parameter Tampering CAPEC-CAPEC-120 · Double Encoding CAPEC-CAPEC-13 · Subverting Environment Variable Values CAPEC-CAPEC-135 · Format String Injection CAPEC-CAPEC-136 · LDAP Injection CAPEC-CAPEC-14 · Client-side Injection-induced Buffer Overflow CAPEC-CAPEC-153 · Input Data Manipulation
⬡

Weakness Classification

CWE-20Improper Input Validation
▤

Affected Products & Versions

7
linux kernel< 2.6.36
fedoraproject fedoraall versions
opensuseall versions
suse linux enterprise desktopall versions
suse linux enterprise real time extensionall versions
suse linux enterprise serverall versions
canonical ubuntu linuxall versions
▤

Related CVEs

8
CVEs linked to this one by a shared weakness (CWE) or affected product - joins on data already in the engine, with the reason shown per row.
CVE-1999-0265 ICMP redirect messages may crash or lock up a host. same CWE-20 CVE-1999-0726 An attacker can conduct a denial of service in Windows NT by executing a program... same CWE-20 CVE-1999-0918 Denial of service in various Windows systems via malformed, fragmented IGMP pack... 3 same CWE-20 CVE-1999-0721 Denial of service in Windows NT Local Security Authority (LSA) through a malform... same CWE-20 CVE-2008-5983 Untrusted search path vulnerability in the PySys_SetArgv API function in Python ... same product CVE-2009-4484 Multiple stack-based buffer overflows in the CertDecoder::GetName function in sr... 1 same product CVE-2009-4895 Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux ... same product MEDIUM CVE-2010-0050 Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remot... 1 same product HIGH
📦

Fixed versions by distribution

21
The package version that resolves this CVE on each Linux distribution, from the vendor’s published security data. fixed in shows a patched version exists; open means the package is listed as affected with no fix yet.
oracle allkernel open
oracle allkernel-debug open
oracle allkernel-debug-devel fixed in 0:2.6.32-100.24.1.el5
oracle allkernel-devel open
oracle allkernel-firmware open
oracle allkernel-headers fixed in 0:2.6.32-100.24.1.el5
oracle allkernel-uek open
oracle allkernel-uek-debug fixed in 0:2.6.32-300.7.1.el6uek
oracle allkernel-uek-debug-devel fixed in 0:2.6.32-300.7.1.el5uek
oracle allkernel-uek-devel open
oracle allkernel-uek-firmware fixed in 0:2.6.32-300.7.1.el6uek
oracle allkernel-uek-headers fixed in 0:2.6.32-300.7.1.el5uek
oracle allmlnx_en-2.6.32-300.7.1.el6uek fixed in 0:1.5.7-0.1
oracle allmlnx_en-2.6.32-300.7.1.el6uekdebug open
oracle allofa-2.6.32-100.24.1.el5 fixed in 0:1.5.1-4.0.23
oracle allofa-2.6.32-100.24.1.el5debug fixed in 0:1.5.1-4.0.23
oracle allofa-2.6.32-300.7.1.el5uek open
oracle allofa-2.6.32-300.7.1.el5uekdebug open
oracle allofa-2.6.32-300.7.1.el6uek fixed in 0:1.5.1-4.0.47
oracle allofa-2.6.32-300.7.1.el6uekdebug fixed in 0:1.5.1-4.0.47
oracle allperf fixed in 0:2.6.32-71.14.1.el6
⚑

Vendor Advisories

9
suse-csafSUSE-SU-2015:0652-1
usnUSN-1119-1
usnUSN-1093-1
usnUSN-1083-1
usnUSN-1074-2
usnUSN-1074-1
usnUSN-1041-1
rhsaRHSA-2010:0958Low
rhsaRHSA-2010:0842Moderate
🔗

References & Sources

16
Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00004.html
Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
Mailing ListThird Party Advisory
http://secunia.com/advisories/42745
Third Party Advisory
http://secunia.com/advisories/42758
Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
Broken Link
http://www.redhat.com/support/errata/RHSA-2010-0842.html
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0958.html
Third Party Advisory
http://www.securityfocus.com/bid/44067
Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/USN-1041-1
Third Party Advisory
http://www.vupen.com/english/advisories/2010/3321
Third Party Advisory
http://www.vupen.com/english/advisories/2011/0070
Third Party Advisory
http://www.vupen.com/english/advisories/2011/0298
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=637688
Issue TrackingPatchThird Party Advisory
◈SOC and Response
◆Detection Engineering
◎Threat Hunting
▲Red Team and Pentest
■Compliance and GRC
◯About
threatengine.sh Crafted with love in Toronto, Canada