CVE-2010-3904

Published: Dec 6, 2010Modified: Apr 21, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Affected (18)

Products: Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server · +3 more

Show all products

Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server · Canonical: Ubuntu Linux · Redhat: Enterprise Linux · Vmware: Esxi

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Real Time Extension

Linux Enterprise Server

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.36

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Suse Linux Enterprise Desktop	Version 11 sp1
Suse Linux Enterprise Real Time Extension	Version 11 sp1
Suse Linux Enterprise Server	Version 11 sp1

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Esxi	Version 3.5
Vmware Esxi	Version 4.0
Vmware Esxi	Version 4.1
Vmware Esxi	Version 5.0

Related CWEs

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (39)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f

Source: security@ubuntu.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html

Source: security@ubuntu.com

ExploitThird Party AdvisoryVDB Entry

http://secunia.com/advisories/46397

Source: security@ubuntu.com

Broken LinkThird Party Advisory

http://securitytracker.com/id?1024613

Source: security@ubuntu.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.kb.cert.org/vuls/id/362983

Source: security@ubuntu.com

Third Party AdvisoryUS Government Resource

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

Source: security@ubuntu.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2010-0792.html

Source: security@ubuntu.com

Broken LinkThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0842.html

Source: security@ubuntu.com

Broken LinkThird Party Advisory

http://www.securityfocus.com/archive/1/520102/100/0/threaded

Source: security@ubuntu.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: security@ubuntu.com

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

Source: security@ubuntu.com

Third Party Advisory

http://www.vsecurity.com/download/tools/linux-rds-exploit.c

Source: security@ubuntu.com

Broken Link

http://www.vsecurity.com/resources/advisory/20101019-1/

Source: security@ubuntu.com

Broken Link

http://www.vupen.com/english/advisories/2011/0298

Source: security@ubuntu.com

Broken LinkThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=642896

Source: security@ubuntu.com

Issue TrackingPatchThird Party Advisory

https://www.exploit-db.com/exploits/44677/

Source: security@ubuntu.com

ExploitThird Party AdvisoryVDB Entry

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f