High severity · published Dec 6, 2010
CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability
In wildKEV
7.8
CVSS
15.9%
EPSS
Yes
On KEV
Description
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.9% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed May 12, 2023
Federal remediation dueJun 2, 2023
Ransomware campaign useNot known
Affected products
Which versions
ES
ESXi · VMware
3.5; 4.0; 4.1; 5.0 · source: NVD
KE
Kernel · Linux
before 2.6.36 · source: NVD, KEV
EL
Enterprise Linux · Redhat
5.0; 6.0 · source: NVD
LE
Linux Enterprise Desktop · Suse
11 · source: NVD
LE
Linux Enterprise Real Time Extension · Suse
11 · source: NVD
LE
Linux Enterprise Server · Suse
11 · source: NVD
OP
Opensuse · Opensuse
11.2; 11.3 · source: NVD
UL
Ubuntu Linux · Canonical
6.06; 8.04; 9.04; 9.10; 10.04; 10.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3904
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
third-party-advisory
http://www.kb.cert.org/vuls/id/362983
x_refsource_MISC
http://www.vsecurity.com/download/tools/linux-rds-exploit.c
vendor-advisory
http://www.ubuntu.com/usn/USN-1000-1
mailing-list
http://www.securityfocus.com/archive/1/520102/100/0/threaded
third-party-advisory
http://secunia.com/advisories/46397
x_refsource_CONFIRM
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability