PT-2010-5158 · Linux+1 · Linux Kernel+1

Dan Rosenberg · CVE-2010-3904 · Publicado 2010-10-25 · Atualizado 2025-02-19

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 2.6.36

Description The issue is related to improper input validation in the Reliable Datagram Sockets (RDS) protocol implementation. Specifically, the rds page copy user function in net/rds/page.c does not properly validate addresses obtained from user space. This allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Recommendations For Linux Kernel versions prior to 2.6.36, update to version 2.6.36 or later to resolve the issue. As a temporary workaround, consider restricting the use of the sendmsg and recvmsg system calls to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-1284

Identificadores relacionados

CVE-2010-3904

RHSA-2010:0792

RHSA-2010:0842

RHSA-2010_0792

RHSA-2010_0842

Produtos afetados

Linux Kernel

Red Hat

Referências · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_rds_page_copy_user_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44677 · Exploit
• 🔥 https://exploit-db.com/exploits/15285 · Exploit
• 🔥 http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html · Exploit
• http://redhat.com/support/errata/RHSA-2010-0792.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2010-0842.html · Aviso do Fabricante
• https://t.me/cvenotify/104995 · Publicação no Telegram
• http://vmware.com/security/advisories/VMSA-2011-0012.html · Nota
• http://vupen.com/english/advisories/2011/0298 · Nota
• http://securitytracker.com/id?1024613 · Nota
• http://securityfocus.com/archive/1/520102/100/0/threaded · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904 · Nota
• http://secunia.com/advisories/46397 · Nota
• http://kb.cert.org/vuls/id/362983 · Nota