CVE-2010-3904: Linux Kernel Improper Input Validation Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed

AliasesRHSA-2010:0792

Published 06-12-2010Last modified 22-10-2025

Vulnerability summary

CVE-2010-3904 is a high (CVSS 7.8) vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 12-05-2023. EPSS estimates a 15.86% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

15.86%

0%100%

Medium · +1.39 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2010:0842

Timeline

06-12-2010
PublishedVulnerability first disclosed.
12-05-2023
Added to CISA KEVLinux Kernel Improper Input Validation Vulnerability
02-06-2023
CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
22-10-2025
Last modifiedVulnerability information updated.

Description

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.8v2.07.2

EPSS trend

Probability

15.86%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+1.39 pp

From 14.47% on 21-09-2026

21-09-202621-10-2026

EPSS score

15.86%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 12-05-2023
Federal due date: 02-06-2023

CISA required action

The impacted product is end-of-life and should be disconnected if still in use. lkml.iu.edu/hypermail/linux/kernel/1601.3/06474.html nvd.nist.gov/vuln/detail/CVE-2010-3904

Public exploits

4 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocallinuxVerified
Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation
exploit/linux/local/rds_rds_page_copy_user_priv_esc
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Affected systems

Redhat19 products

enterprise_linuxEOL5.0 | 6.0
kernel< 0:2.6.18-194.17.4.el5
kernel-debug< 0:2.6.18-194.17.4.el5
kernel-debug-debuginfo< 0:2.6.18-194.17.4.el5
kernel-debug-devel< 0:2.6.18-194.17.4.el5

Show all 19

Suse3 products

linux_enterprise_desktop11:sp1
linux_enterprise_real_time_extension11:sp1
linux_enterprise_server11:sp1

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 9.04 | 9.10 | 10.04 | 10.10

Linux1 product

linux_kernel< 2.6.36

Opensuse1 product

opensuseEOL11.2 | 11.3

Vmware1 product

esxiEOL3.5 | 4.0 | 4.1 | 5.0

6 vendors · 26 products

References

27 links

www.kb.cert.org/vuls/id/362983Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.vsecurity.com/download/tools/linux-rds-exploit.cX Refsource MISCBroken Link
www.ubuntu.com/usn/USN-1000-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/archive/1/520102/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/46397Third Party AdvisoryX Refsource SECUNIABroken Link
git.kernel.orgX Refsource CONFIRMBroken Link
www.exploit-db.com/exploits/44677/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
securitytracker.com/id?1024613VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.redhat.com/support/errata/RHSA-2010-0842.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory

Show all 27 references

www.vupen.com/english/advisories/2011/0298VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=642896X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.vmware.com/security/advisories/VMSA-2011-0012.htmlX Refsource CONFIRMThird Party Advisory
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36X Refsource CONFIRMBroken Link
www.vsecurity.com/resources/advisory/20101019-1/X Refsource MISCBroken Link
www.redhat.com/support/errata/RHSA-2010-0792.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3904Government ResourceUS Government Resource
access.redhat.com/errata/RHSA-2010:0792Advisory
www.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0792.jsonAdvisory
access.redhat.com/security/cve/CVE-2010-3904REPORT
www.cve.org/CVERecord?id=CVE-2010-3904Advisory
nvd.nist.gov/vuln/detail/CVE-2010-3904Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities