CVE-2010-3904
At a glance
- Source
- NVD
- EPSS
- EPSS 15.86 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- canonical
- NVD status
- Analyzed
Description
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Weaknesses (CWE)
- CWE-1284 — Improper Validation of Specified Quantity in Input
References
- http://www.kb.cert.org/vuls/id/362983
- http://www.vsecurity.com/download/tools/linux-rds-exploit.c
- http://www.ubuntu.com/usn/USN-1000-1
- http://www.securityfocus.com/archive/1/520102/100/0/threaded
- http://secunia.com/advisories/46397
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- https://www.exploit-db.com/exploits/44677/
- http://securitytracker.com/id?1024613
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://www.redhat.com/support/errata/RHSA-2010-0842.html
- http://www.vupen.com/english/advisories/2011/0298
- https://bugzilla.redhat.com/show_bug.cgi?id=642896
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- http://www.vsecurity.com/resources/advisory/20101019-1/
- http://www.redhat.com/support/errata/RHSA-2010-0792.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2010-3882
- GCVE · GCVE-0-2010-3904
CERT-FR advisories
- CERTA-2011-AVI-571 — Vulnérabilités dans VMWare ESX et ESXi · cert.ssi.gouv.fr
- CERTA-2010-AVI-511 — Vulnérabilité dans le noyau Linux · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 2.6.36cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |