CVE-2010-3904: Linux Kernel Improper Input Validation Vulnerability
Description of problem: The handling functions for sending and receiving messages, in rdspagecopyuser(), use the unchecked copyuserinatomic functions without any access checks on user-provided pointers. As a result, by passing a kernel address as an iovec base address in recvmsg-style calls, a local user can overwrite arbitrary kernel memory, which can easily be used to escalate privileges to root.
Introduced via 7875e18e (v2.6.30-rc1).
Acknowledgements:
Red Hat would like to thank Dan Rosenberg of Virtual Security Research for reporting this issue.
Other sources
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
— CISA
The rdspagecopyuser function in net/rds/page.c in the Reliable Data ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Kernel-develto a version that resolves this vulnerability.Fixed in 2.6.36 - Upgrade
Upgrade
debian/linux-2.6to a version that resolves this vulnerability.Fixed in 2.6.36 - Compensating control
Disconnect the impacted end-of-life product from the network and isolate it from production systems if it is still in use.
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3904?
CVE-2010-3904 has a high severity rating due to its potential to allow arbitrary memory access.
How do I fix CVE-2010-3904?
To fix CVE-2010-3904, update the Linux kernel to a version that is equal to or greater than 2.6.36.
Which systems are affected by CVE-2010-3904?
CVE-2010-3904 affects multiple distributions including Ubuntu, SUSE, Red Hat, and VMware ESXi.
What type of vulnerability is CVE-2010-3904?
CVE-2010-3904 is a kernel memory access vulnerability.
Can CVE-2010-3904 be exploited remotely?
Yes, CVE-2010-3904 can be exploited remotely if the attacker can communicate with the affected service.