CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability
Description
CVE-2010-3904 is a privilege escalation vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. The flaw resides in the rds_page_copy_user function within net/rds/page.c, where user-space addresses are not properly validated during sendmsg and recvmsg system calls. A local attacker with low-level privileges can exploit this improper input validation vulnerability to gain elevated privileges on the affected system, potentially obtaining root access. CVE-2010-3904 affects Linux kernel versions prior to 2.6.36 and is listed in CISA's Known Exploited Vulnerabilities catalog. With a CVSS score of 7.8 (High) and an EPSS score of 1.7% (82nd percentile), this vulnerability poses a significant risk to unpatched Linux systems including those running Red Hat Enterprise Linux, SUSE, Ubuntu, openSUSE, and VMware ESXi.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | < 2.6.36 |
| opensuse | opensuse | 11.2; 11.3 |
| suse | linux enterprise desktop | 11 |
| suse | linux enterprise real time extension | 11 |
| suse | linux enterprise server | 11 |
| canonical | ubuntu linux | 6.06; 8.04; 9.04; 9.10; 10.04; 10.10 |
| redhat | enterprise linux | 5.0; 6.0 |
| vmware | esxi | 3.5; 4.0; 4.1; 5.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f(Broken Link)
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://secunia.com/advisories/46397(Broken Link, Third Party Advisory)
- http://securitytracker.com/id?1024613(Broken Link, Third Party Advisory, VDB Entry)
- http://www.kb.cert.org/vuls/id/362983(Third Party Advisory, US Government Resource)
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36(Broken Link)
- http://www.redhat.com/support/errata/RHSA-2010-0792.html(Broken Link, Third Party Advisory)
- http://www.redhat.com/support/errata/RHSA-2010-0842.html(Broken Link, Third Party Advisory)
- http://www.securityfocus.com/archive/1/520102/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-1000-1(Third Party Advisory)
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html(Third Party Advisory)
- http://www.vsecurity.com/download/tools/linux-rds-exploit.c(Broken Link)
- http://www.vsecurity.com/resources/advisory/20101019-1/(Broken Link)
- http://www.vupen.com/english/advisories/2011/0298(Broken Link, Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=642896(Issue Tracking, Patch, Third Party Advisory)
- https://www.exploit-db.com/exploits/44677/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904(US Government Resource)
Weakness Type
CWE-1284: Improper Validation of Specified Quantity in Input
CWE-1284 describes a weakness where software does not properly validate the quantity or size of input data before processing it. In CVE-2010-3904, the Linux kernel's RDS protocol implementation fails to validate user-space addresses passed through the sendmsg and recvmsg system calls, allowing an attacker to provide crafted input that bypasses intended memory access restrictions and escalates privileges.
Learn more: CWE-1284 — Improper Validation of Specified Quantity in Input
Impact Analysis
Attack Vector (Local): CVE-2010-3904 requires local access to exploit, meaning an attacker needs an existing user session or shell on the affected Linux system. Attack Complexity (Low): The exploitation path is straightforward with no special conditions required beyond having local access and the RDS module loaded. Privileges Required (Low): A standard unprivileged user account is sufficient to trigger the vulnerability through crafted sendmsg and recvmsg system calls. User Interaction (None): No action from another user is needed for successful exploitation. Confidentiality, Integrity, and Availability (All High): Successful exploitation of CVE-2010-3904 grants full system compromise, allowing an attacker to read sensitive data, modify system files, and disrupt services. The CVSS score of 7.8 (High severity) reflects the complete compromise of the local system. While the EPSS score of 1.7% is moderate, CISA has confirmed active exploitation in the wild, making this vulnerability a high-priority patching target for any system running affected kernel versions.
Exploit Maturity
Public exploit code is available for CVE-2010-3904 through multiple sources, including Packet Storm Security and Exploit-DB. Active exploitation has been confirmed by CISA, which added this Linux kernel vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 1.7% places CVE-2010-3904 in the 82nd percentile, indicating moderate exploitation probability. While the ransomware usage status is currently unknown, the availability of mature exploit code for privilege escalation combined with confirmed active exploitation makes immediate patching essential for all affected systems.
Remediation
- Apply kernel patches immediately as directed by CISA's required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade the Linux kernel to version 2.6.36 or later, which contains the fix in commit 799c10559d60f159ab2232203f222f18fa3c4a5f.
- Update distribution-specific packages by applying the relevant security advisories: Red Hat (RHSA-2010-0792, RHSA-2010-0842), Ubuntu (USN-1000-1), SUSE and openSUSE (openSUSE-SU-2010:0783, SUSE-SA:2011:007), and VMware ESXi (VMSA-2011-0012).
- Disable the RDS kernel module as an interim mitigation if immediate patching is not possible. Run "modprobe -r rds" and add "blacklist rds" to /etc/modprobe.d/blacklist.conf to prevent the module from loading. This eliminates the attack surface entirely for systems that do not require RDS functionality.
- Audit local user accounts and restrict shell access to only those users who require it. Since CVE-2010-3904 requires local access, reducing the number of interactive users limits the pool of potential attackers.
- Monitor for privilege escalation indicators by reviewing system logs for unexpected setuid changes, suspicious process executions from non-privileged users, and unusual RDS socket activity using tools like auditd or sysdig.
Technical Details
Vulnerability mechanism: CVE-2010-3904 exists in the rds_page_copy_user function within net/rds/page.c of the Linux kernel's RDS protocol implementation, where addresses obtained from user space are not properly validated before being used in memory operations. This improper input validation (CWE-1284) allows an attacker to supply crafted addresses through the sendmsg and recvmsg system calls that bypass kernel memory protection boundaries. Exploitation technique: By manipulating the addresses passed to RDS socket operations, a local attacker can read from or write to arbitrary kernel memory locations, effectively converting an input validation flaw into a full privilege escalation primitive. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that exploitation leads to complete confidentiality, integrity, and availability compromise within the local system scope. Root cause: The RDS subsystem trusted user-provided addresses without sufficient bounds checking, and the fix added proper validation to ensure that only legitimate user-space addresses are accepted by the rds_page_copy_user function.
Frequently Asked Questions
Is CVE-2010-3904 being actively exploited?
Yes, CVE-2010-3904 is confirmed to be actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. Public exploit code is available through multiple sources including Packet Storm Security and Exploit-DB, making it accessible to a wide range of attackers.
What products are affected by CVE-2010-3904?
CVE-2010-3904 affects the Linux kernel versions prior to 2.6.36. This impacts major distributions including Red Hat Enterprise Linux, openSUSE, SUSE Linux Enterprise Server and Desktop, Canonical Ubuntu Linux, and VMware ESXi. Any system running an affected kernel version with the RDS module loaded is potentially vulnerable.
How do I fix CVE-2010-3904?
Upgrade the Linux kernel to version 2.6.36 or later to fully remediate CVE-2010-3904. Alternatively, apply distribution-specific patches from your vendor (e.g., RHSA-2010-0792 for Red Hat, USN-1000-1 for Ubuntu). As an interim mitigation, disable the RDS kernel module by running "modprobe -r rds" and blacklisting it. See the Remediation section for detailed steps.
How severe is CVE-2010-3904?
CVE-2010-3904 has a CVSS v3.1 base score of 7.8 (High severity), reflecting the ability to achieve full system compromise including complete confidentiality, integrity, and availability impact. The EPSS percentile of 82.3% indicates moderate-to-high exploitation probability, and CISA has confirmed active exploitation in the wild. This is a critical vulnerability for any unpatched Linux system with the RDS module enabled.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.