Vulnerability CVE-2010-3904

Vulnerability CVE-2010-3904

Published: 2010-12-06 Modified: 2012-02-13

Description:

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Linux RDS Protocol Local Privilege Escalation	Dan Rosenberg	20.10.2010
Med.	Reliable Datagram Sockets (RDS) Privilege Escalation	Dan Rosenberg	21.05.2018
Med.	vReliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation	Dan Rosenberg	24.12.2019

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.2/10	10/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Linux -> Kernel
Linux -> Linux kernel

References:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=799c10559d60f159ab2232203f222f18fa3c4a5f

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

http://securitytracker.com/id?1024613

http://www.kb.cert.org/vuls/id/362983

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

http://www.redhat.com/support/errata/RHSA-2010-0792.html

http://www.redhat.com/support/errata/RHSA-2010-0842.html

http://www.securityfocus.com/archive/1/520102/100/0/threaded

http://www.ubuntu.com/usn/USN-1000-1

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

http://www.vsecurity.com/download/tools/linux-rds-exploit.c

http://www.vsecurity.com/resources/advisory/20101019-1/

http://www.vupen.com/english/advisories/2011/0298

https://bugzilla.redhat.com/show_bug.cgi?id=642896

https://www.exploit-db.com/exploits/44677/

Vulnerability CVE-2010-3904

See advisories in our WLB2 database:

High

Linux RDS Protocol Local Privilege Escalation

Med.

Reliable Datagram Sockets (RDS) Privilege Escalation

Med.

vReliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation

CWE-20

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

7.2/10

10/10

3.9/10

Local

Low

No required

Complete

Complete

Complete

Affected software

References: