{"id":"CVE-2010-3904","kind":"vulnerability","aliases":["CVE-2010-3904"],"related":[],"title":"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in…","description":"Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.\n\nCISA required action: The impacted product is end-of-life and should be disconnected if still in use.","summary":"The Linux kernel's Reliable Datagram Sockets (RDS) code does not validate input properly in sendmsg and recvmsg. A local user can use crafted calls to gain elevated privileges, which can mean full root on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-05-12T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["2.6.36"],"affected":"< 2.6.36","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.2","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.3","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"suse linux enterprise real time extension","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"suse linux enterprise server","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 6.06","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 8.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 9.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 9.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 10.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 10.10","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 3.5","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 4.1","ecosystem":"vendor"},{"name":"vmware esxi","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["managed-hosting","rds-module-not-loaded"],"how_to_check":null,"fix":"Upgrade to a kernel release that includes the RDS input validation fix; the sources do not name the fixed version. CISA says the affected product is end-of-life and should be disconnected if still in use.","status":"open","published_at":"2010-12-06T20:13:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:47+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a kernel release that includes the RDS input validation fix; the sources do not name the fixed version. CISA says the affected product is end-of-life and should be disconnected if still in use.","reach":"local","impact":"high","summary":"The Linux kernel's Reliable Datagram Sockets (RDS) code does not validate input properly in sendmsg and recvmsg. A local user can use crafted calls to gain elevated privileges, which can mean full root on the machine.","category":"infrastructure","who_cares":["linux","self-hosted","kernel"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root privileges on the kernel host","analyst_note":"Find the fixed kernel versions and the RDS module check (lsmod | grep rds) from the NVD or kernel.org entry for CVE-2010-3904, and confirm which distros still ship the vulnerable code.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["rds-module-not-loaded","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000481,"input_tokens":2823,"output_tokens":397,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2010':18A,21A '-3904':19A,22A 'action':154C 'allow':136C 'call':106B,151C 'canonical':41A,44A,47A,50A,53A,56A 'cisa':152C 'code':90B 'contain':121C 'copi':4A 'craft':105B,143C 'cve':17A,20A 'datagram':12A,87B,130C 'desktop':30A 'disconnect':166C 'elev':109B 'end':160C 'end-of-lif':159C 'enterprise':29A,33A,39A,60A,63A 'esxi':66A,68A,70A,72A 'exploit':75B 'extension':36A 'full':114B 'function':6A 'gain':108B,140C 'host':81B 'impact':156C 'implement':16A,134C 'improp':123C 'infrastructur':76B 'input':94B,124C 'kernel':24A,74A,77B,84B,120C 'life':162C 'linux':23A,28A,32A,38A,43A,46A,49A,52A,55A,58A,61A,64A,73A,78B,83B,119C 'local':101B,137C 'machin':118B 'mean':113B 'net/rds/page.c':8A 'opensuse':25A,26A 'page':3A 'privileg':110B,141C 'product':157C 'proper':95B 'protocol':15A,133C 'rds':2A,14A,89B,132C 'real':34A 'recvmsg':99B,149C 'redhat':59A,62A 'reliabl':11A,86B,129C 'requir':153C 'root':115B 'self':80B 'self-host':79B 'sendmsg':97B,147C 'server':40A 'socket':13A,88B,131C 'still':168C 'suse':27A,31A,37A 'system':150C 'time':35A 'ubuntu':42A,45A,48A,51A,54A,57A 'use':104B,144C,170C 'user':5A,102B,138C 'valid':93B,125C 'via':142C 'vmware':65A,67A,69A,71A 'vulner':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-12-06T20:13:00+00:00","kev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-3904","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-3904","severity":null,"published_at":"2023-05-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-3904","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3904","severity":null,"published_at":"2010-12-06T20:13:00+00:00","modified_at":"2026-06-16T23:23:47+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}