CVE-2010-3904
גבוהה 7.8 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- Linux Kernel Improper Input Validation Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- The impacted product is end-of-life and should be disconnected if still in use.
תיאור (מקור, אנגלית)
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
מדדים
- CVSS 3.1
-
7.8 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 12% (אחוזון 100) נכון ל-24/7/2026
- CWE
- CWE-1284
מוצרים מושפעים
linux: linux kernel; opensuse: opensuse; suse: linux enterprise desktop; suse: linux enterprise real time extension; suse: linux enterprise server; canonical: ubuntu linux; redhat: enterprise linux; vmware: esxi
קישורים
- https://bugzilla.redhat.com/show_bug.cgi?id=642896 Issue TrackingPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=642896 Issue TrackingPatchThird Party Advisory
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds… ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44677/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds… ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44677/ ExploitThird Party AdvisoryVDB Entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3B… Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html Mailing ListThird Party Advisory