{"id":"CVE-2010-3904","state":"PUBLISHED","title":"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addres","description":"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.","publishedAt":"2010-12-06T20:00:00.000Z","updatedAt":"2025-10-22T00:05:50.418Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"canonical","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://www.kb.cert.org/vuls/id/362983","http://www.vsecurity.com/download/tools/linux-rds-exploit.c","http://www.ubuntu.com/usn/USN-1000-1","http://www.securityfocus.com/archive/1/520102/100/0/threaded","http://secunia.com/advisories/46397","http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f","https://www.exploit-db.com/exploits/44677/","http://securitytracker.com/id?1024613","http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html","http://www.redhat.com/support/errata/RHSA-2010-0842.html","http://www.vupen.com/english/advisories/2011/0298","https://bugzilla.redhat.com/show_bug.cgi?id=642896","http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html","http://www.vmware.com/security/advisories/VMSA-2011-0012.html","http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36","http://www.vsecurity.com/resources/advisory/20101019-1/","http://www.redhat.com/support/errata/RHSA-2010-0792.html","http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html","http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904"],"weaknesses":[],"ingestedAt":"2026-10-29T19:39:43.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2010/3xxx/CVE-2010-3904.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2010-3904","state":"PUBLISHED","datePublished":"2010-12-06T20:00:00.000Z","dateUpdated":"2025-10-22T00:05:50.418Z","assignerShortName":"canonical","assignerOrgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","dateReserved":"2010-10-12T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://www.kb.cert.org/vuls/id/362983","name":"VU#362983","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.vsecurity.com/download/tools/linux-rds-exploit.c","tags":["x_refsource_MISC"]},{"url":"http://www.ubuntu.com/usn/USN-1000-1","name":"USN-1000-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/archive/1/520102/100/0/threaded","name":"20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://secunia.com/advisories/46397","name":"46397","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/44677/","name":"44677","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://securitytracker.com/id?1024613","name":"1024613","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html","name":"SUSE-SA:2011:007","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0842.html","name":"RHSA-2010:0842","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.vupen.com/english/advisories/2011/0298","name":"ADV-2011-0298","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=642896","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html","name":"SUSE-SA:2010:057","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0012.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vsecurity.com/resources/advisory/20101019-1/","tags":["x_refsource_MISC"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0792.html","name":"RHSA-2010:0792","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html","name":"SUSE-SA:2010:053","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"canonical","dateUpdated":"2019-12-23T22:06:04.000Z","orgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc"},"datePublic":"2010-10-19T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@ubuntu.com","ID":"CVE-2010-3904","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"VU#362983","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/362983"},{"name":"http://www.vsecurity.com/download/tools/linux-rds-exploit.c","refsource":"MISC","url":"http://www.vsecurity.com/download/tools/linux-rds-exploit.c"},{"name":"USN-1000-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1000-1"},{"name":"20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/520102/100/0/threaded"},{"name":"46397","refsource":"SECUNIA","url":"http://secunia.com/advisories/46397"},{"name":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=799c10559d60f159ab2232203f222f18fa3c4a5f","refsource":"CONFIRM","url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=799c10559d60f159ab2232203f222f18fa3c4a5f"},{"name":"44677","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/44677/"},{"name":"1024613","refsource":"SECTRACK","url":"http://securitytracker.com/id?1024613"},{"name":"SUSE-SA:2011:007","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html"},{"name":"RHSA-2010:0842","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2010-0842.html"},{"name":"ADV-2011-0298","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2011/0298"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=642896","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=642896"},{"name":"SUSE-SA:2010:057","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html"},{"name":"http://www.vmware.com/security/advisories/VMSA-2011-0012.html","refsource":"CONFIRM","url":"http://www.vmware.com/security/advisories/VMSA-2011-0012.html"},{"name":"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36","refsource":"CONFIRM","url":"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36"},{"name":"http://www.vsecurity.com/resources/advisory/20101019-1/","refsource":"MISC","url":"http://www.vsecurity.com/resources/advisory/20101019-1/"},{"name":"RHSA-2010:0792","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2010-0792.html"},{"name":"SUSE-SA:2010:053","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html"},{"name":"http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.kb.cert.org/vuls/id/362983","name":"VU#362983","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"]},{"url":"http://www.vsecurity.com/download/tools/linux-rds-exploit.c","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1000-1","name":"USN-1000-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/520102/100/0/threaded","name":"20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/46397","name":"46397","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/44677/","name":"44677","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://securitytracker.com/id?1024613","name":"1024613","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html","name":"SUSE-SA:2011:007","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0842.html","name":"RHSA-2010:0842","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2011/0298","name":"ADV-2011-0298","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=642896","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html","name":"SUSE-SA:2010:057","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0012.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.vsecurity.com/resources/advisory/20101019-1/","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0792.html","name":"RHSA-2010:0792","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html","name":"SUSE-SA:2010:053","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-07T03:26:12.057Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2010-3904","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-07T12:31:23.893469Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2023-05-12","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-22T00:05:50.418Z"},"timeline":[{"time":"2023-05-12T00:00:00.000Z","lang":"en","value":"CVE-2010-3904 added to CISA KEV"}]}]}}}