CyberSecBulletin
CVE-2010-3904Exploited in the wildNVD status: Analyzed

Linux Kernel Improper Input Validation

Published Updated By the CyberSecBulletin desk

CVE-2010-3904 is a high-severity improper validation of specified quantity in input vulnerability in Linux Kernel from Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version 2.6.36 as the first without the flaw, so updating Linux Kernel to that release or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on May 12, 2023, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Linux Kernel to 2.6.36 or a later version.
  2. CISA's required action: The impacted product is end-of-life and should be disconnected if still in use.
  3. Read the advisory on vmware.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux Kernelbefore 2.6.362.6.36
openSUSEOpensuse11.2; 11.3Not stated
SUSELinux Enterprise Desktop11Not stated
SUSELinux Enterprise Real Time Extension11Not stated
SUSELinux Enterprise Server11Not stated
CanonicalUbuntu Linux6.06; 8.04; 9.04; 9.10; 10.04; 10.10Not stated
Red HatEnterprise Linux5.0; 6.0Not stated
VMwareEsxi3.5; 4.0; 4.1; 5.0Not stated

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)
CVSS 2.07.2HighNVD

Official description

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

More Improper Validation of Specified Quantity in Input vulnerabilities (CWE-1284)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  5. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Third-party and government advisories

Technical write-ups (may include proof of concept)

Other vulnerabilities in Linux Kernel

All Linux Kernel vulnerabilities

Spotted an error? Tell us.