# CVE-2010-3904

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

- Page: https://www.vulneraibility.com/cve/CVE-2010-3904
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2023-05-12; CISA due date 2023-06-02
- EPSS: 15.86% (percentile 96.9)
- Public exploit code: 3 on Exploit-DB · 1 Metasploit module · 1 GitHub proof of concept (first 2010-10-19)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-07)
- Published: 2010-12-06

## Affected

- linux:linux_kernel
- opensuse:opensuse
- suse:linux_enterprise_desktop
- suse:linux_enterprise_real_time_extension
- suse:linux_enterprise_server
- canonical:ubuntu_linux
- redhat:enterprise_linux
- vmware:esxi

## References

- [advisory] http://www.kb.cert.org/vuls/id/362983
- [other] http://www.vsecurity.com/download/tools/linux-rds-exploit.c
- [advisory] http://www.ubuntu.com/usn/USN-1000-1
- [other] http://www.securityfocus.com/archive/1/520102/100/0/threaded
- [advisory] http://secunia.com/advisories/46397
- [other] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- [exploit] https://www.exploit-db.com/exploits/44677/
- [other] http://securitytracker.com/id?1024613
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- [advisory] http://www.redhat.com/support/errata/RHSA-2010-0842.html
- [other] http://www.vupen.com/english/advisories/2011/0298
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=642896
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html
- [other] http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- [other] http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- [other] http://www.vsecurity.com/resources/advisory/20101019-1/
- [advisory] http://www.redhat.com/support/errata/RHSA-2010-0792.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
- [other] http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.