Vulnerability Description
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 2.6.36 |
| Opensuse | Opensuse | 11.2 |
| Suse | Linux Enterprise Desktop | 11 |
| Suse | Linux Enterprise Real Time Extension | 11 |
| Suse | Linux Enterprise Server | 11 |
| Canonical | Ubuntu Linux | 6.06 |
| Redhat | Enterprise Linux | 5.0 |
| Vmware | Esxi | 3.5 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_pExploitThird Party AdvisoryVDB Entry
- http://secunia.com/advisories/46397Broken LinkThird Party Advisory
- http://securitytracker.com/id?1024613Broken LinkThird Party AdvisoryVDB Entry
- http://www.kb.cert.org/vuls/id/362983Third Party AdvisoryUS Government Resource
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36Broken Link
- http://www.redhat.com/support/errata/RHSA-2010-0792.htmlBroken LinkThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0842.htmlBroken LinkThird Party Advisory
- http://www.securityfocus.com/archive/1/520102/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-1000-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0012.htmlThird Party Advisory
- http://www.vsecurity.com/download/tools/linux-rds-exploit.cBroken Link
FAQ
What is CVE-2010-3904?
CVE-2010-3904 is a vulnerability with a CVSS score of 7.8 (HIGH). The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from us...
How severe is CVE-2010-3904?
CVE-2010-3904 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-3904?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Opensuse Opensuse, Suse Linux Enterprise Desktop, Suse Linux Enterprise Real Time Extension, Suse Linux Enterprise Server.