All vulnerabilities
CVE-2010-3904

Linux Kernel Improper Input Validation Vulnerability

Linux KernelOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 12 May 2023CISA KEV
Exploit odds (EPSS)15.9%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Federal deadline2 Jun 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionThe impacted product is end-of-life and should be disconnected if still in use. CISA KEV

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 19 Oct 2010Exploit code publicExploit-DB
  2. 6 Dec 2010, 20:00 UTCPublishedCVE List
  3. 12 May 2023Added to CISA KEVCISA KEV

Public exploit code and templates 4

  • Exploit moduleReliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation 20 Oct 2010Metasploit
  • Local exploitLinux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit) 21 May 2018Exploit-DB
  • Local exploitLinux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit) 21 May 2018Exploit-DB
  • Local exploitLinux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation 19 Oct 2010Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Text from CVE List

Affected versions 1

  • n/aaffected: n/aCVE List

References 5