CVE-2010-3904
high · 7.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
The impacted product is end-of-life and should be disconnected if still in use.
Added 2023-05-12Remediation due 2023-06-02
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
7.8
CVSS
14.5%
EPSS (exploit prob.)
96th
EPSS percentile
2010-12-06
Published
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1284
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux_kernel | < 2.6.36 |
| opensuse | opensuse | 11.2 |
| opensuse | opensuse | 11.3 |
| suse | linux_enterprise_desktop | 11 |
| suse | linux_enterprise_real_time_extension | 11 |
| suse | linux_enterprise_server | 11 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 8.04 |
| canonical | ubuntu_linux | 9.04 |
| canonical | ubuntu_linux | 9.10 |
| canonical | ubuntu_linux | 10.04 |
| canonical | ubuntu_linux | 10.10 |
| redhat | enterprise_linux | 5.0 |
| redhat | enterprise_linux | 6.0 |
| vmware | esxi | 3.5 |
| vmware | esxi | 4.0 |
| vmware | esxi | 4.1 |
| vmware | esxi | 5.0 |
Check a specific version with /api/v1/cve/match.
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- http://secunia.com/advisories/46397
- http://securitytracker.com/id?1024613
- http://www.kb.cert.org/vuls/id/362983
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- http://www.redhat.com/support/errata/RHSA-2010-0792.html
- http://www.redhat.com/support/errata/RHSA-2010-0842.html
- http://www.securityfocus.com/archive/1/520102/100/0/threaded
- http://www.ubuntu.com/usn/USN-1000-1
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://www.vsecurity.com/download/tools/linux-rds-exploit.c
- http://www.vsecurity.com/resources/advisory/20101019-1/
- http://www.vupen.com/english/advisories/2011/0298
- https://bugzilla.redhat.com/show_bug.cgi?id=642896
- https://www.exploit-db.com/exploits/44677/
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- http://secunia.com/advisories/46397
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2010-3904