CVE-2010-3904
CVE-2010-3904
In short
A flaw in the Linux kernel's RDS networking code fails to properly check memory addresses provided by users, allowing someone on the system to gain administrative privileges by sending specially crafted network messages.
Technical detail
The rds_page_copy_user function in net/rds/page.c lacks proper validation of user-supplied memory addresses, enabling local privilege escalation via malicious sendmsg/recvmsg syscalls. Exploitation requires local access and results in kernel-level code execution.
Summary generated and translated by AI from the official description.
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 5
githubgithub.com/redhatkaty/-cve-2010-3904-report★ 0cve_referencepacketstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.htmlunverifiedcve_referencewww.exploit-db.com/exploits/44677/unverifiedexploitdbwww.exploit-db.com/exploits/44677unverifiedexploitdbwww.exploit-db.com/exploits/15285unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5fhttp://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=642896http://secunia.com/advisories/46397http://securitytracker.com/id?1024613https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904https://www.exploit-db.com/exploits/44677/http://www.kb.cert.org/vuls/id/362983http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36