CVE-2010-3904

Estado: AnalizadaAlta (7.8)⚠ Explotación activa

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 16%
Percentil entre todas las CVEs puntuadas: 97
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 12/5/2023
Plazo de remediación: 2/6/2023
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation95 %
Impacto secundarioT1548 Abuse Elevation Control Mechanismprivilege escalation90 %

Vulnerabilidad local de escalada de privilegios en RDS del kernel Linux (CWE-1284, validación deficiente). Vector AV:L/PR:L confirma explotación local. Permite ejecutar comandos con privilegios elevados tras ganar acceso root.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Update Software User Account Management Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management

Tecnologías afectadas (8)

Canonical — Ubuntu Linux Linux — Linux Kernel Opensuse — Opensuse Redhat — Enterprise Linux Suse — Linux Enterprise Desktop Suse — Linux Enterprise Real Time Extension Suse — Linux Enterprise Server Vmware — Esxi

CWE

CWE-1284

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2010-3904",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2010-3904",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-07T12:31:23.893469Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-12-06T20:13:00.513",
  "references": [
    {
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f",
      "tags": [
        "Broken Link"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/46397",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://securitytracker.com/id?1024613",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/362983",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36",
      "tags": [
        "Broken Link"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0792.html",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0842.html",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/520102/100/0/threaded",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1000-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0012.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vsecurity.com/download/tools/linux-rds-exploit.c",
      "tags": [
        "Broken Link"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vsecurity.com/resources/advisory/20101019-1/",
      "tags": [
        "Broken Link"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0298",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=642896",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44677/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/46397",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1024613",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/362983",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0792.html",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0842.html",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/520102/100/0/threaded",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1000-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0012.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vsecurity.com/download/tools/linux-rds-exploit.c",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vsecurity.com/resources/advisory/20101019-1/",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0298",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=642896",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44677/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls."
    },
    {
      "lang": "es",
      "value": "La función rds_page_copy_user de net/rds/page.c en la implementación del protocolo \"Reliable Datagram Sockets\" (RDS) del kernel de Linux en versiones anteriores a la 2.6.36 no valida apropiadamente las direcciones obtenidas del espacio de usuario, lo que permite a usuarios locales escalar privilegios a través de un uso manipulado de las llamadas del sistema sendmsg y recvmsg."
    }
  ],
  "lastModified": "2026-06-16T23:23:47.610",
  "cisaActionDue": "2023-06-02",
  "cisaExploitAdd": "2023-05-12",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8DCE5E2-B055-4F05-8F0F-F19D1B7BA8D7",
              "versionEndExcluding": "2.6.36"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5646FDE9-CF21-46A9-B89D-F5BBDB4249AF"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60FBDD82-691C-4D9D-B71B-F9AFF6931B53"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "640FB29C-1A84-41E1-86DE-B542EA0EF153"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE26596F-F10E-44EF-88CA-0080646E91B9"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EBFE35C-E243-43D1-883D-4398D71763CC"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5D026D0-EF78-438D-BEDD-FC8571F3ACEB"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2BCB73E-27BB-4878-AD9C-90C4F20C25A0"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01EDA41C-6B2E-49AF-B503-EB3882265C11"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87614B58-24AB-49FB-9C84-E8DDBA16353B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAE88D8C-9CC3-46D1-9F26-290BC679F47E"
            },
            {
              "criteria": "cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13771B15-CD71-472A-BE56-718B87D5825D"
            },
            {
              "criteria": "cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BDE707D-A1F4-4829-843E-F6633BB84D6D"
            },
            {
              "criteria": "cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2331236-2E9B-4B52-81EE-B52DEB41ACE5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "cisaRequiredAction": "The impacted product is end-of-life and should be disconnected if still in use.",
  "cisaVulnerabilityName": "Linux Kernel Improper Input Validation Vulnerability"
}