high7.8Known exploitedPublic exploit code
CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-05-12. Federal due date: 2023-06-02.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)2018-05-21 · local · linux · Verified
- Linux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation2010-10-19 · local · linux · Verified
Impact
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | before 2.6.36 |
| Opensuse | Opensuse | Versions 11.2, 11.3 |
| Suse | Linux Enterprise Desktop | Version 11 |
| Suse | Linux Enterprise Real Time Extension | Version 11 |
| Suse | Linux Enterprise Server | Version 11 |
| Canonical | Ubuntu Linux | Versions 6.06, 8.04, 9.04, 9.10, 10.04, 10.10 |
| Redhat | Enterprise Linux | Versions 5.0, 6.0 |
| Vmware | Esxi | Versions 3.5, 4.0, 4.1, 5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- http://secunia.com/advisories/46397
- http://securitytracker.com/id?1024613
- http://www.kb.cert.org/vuls/id/362983
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- http://www.redhat.com/support/errata/RHSA-2010-0792.html
- http://www.redhat.com/support/errata/RHSA-2010-0842.html
- http://www.securityfocus.com/archive/1/520102/100/0/threaded
- http://www.ubuntu.com/usn/USN-1000-1
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://www.vsecurity.com/download/tools/linux-rds-exploit.c
- http://www.vsecurity.com/resources/advisory/20101019-1/
- http://www.vupen.com/english/advisories/2011/0298
- https://bugzilla.redhat.com/show_bug.cgi?id=642896
- https://www.exploit-db.com/exploits/44677/
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- http://secunia.com/advisories/46397