PT-2010-5158 · Linux+1 · Linux Kernel+1

Dan Rosenberg · Published 2010-10-25 · Updated 2025-02-19 · CVE-2010-3904

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 2.6.36

Description The issue is related to improper input validation in the Reliable Datagram Sockets (RDS) protocol implementation. Specifically, the rds page copy user function in net/rds/page.c does not properly validate addresses obtained from user space. This allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Recommendations For Linux Kernel versions prior to 2.6.36, update to version 2.6.36 or later to resolve the issue. As a temporary workaround, consider restricting the use of the sendmsg and recvmsg system calls to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2010-3904

RHSA-2010:0792

RHSA-2010:0842

RHSA-2010_0792

RHSA-2010_0842

Affected Products

Linux Kernel

Red Hat

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_rds_page_copy_user_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44677 · Exploit
• 🔥 https://exploit-db.com/exploits/15285 · Exploit
• 🔥 http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html · Exploit
• http://redhat.com/support/errata/RHSA-2010-0792.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0842.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3904 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=642896 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1000-1 · Vendor Advisory
• https://lkml.iu.edu/hypermail/linux/kernel/1601.3/06474.html · Security Note
• https://t.me/cvenotify/104995 · Telegram Post