CVE-2010-3865
published 2011-01-11CVE-2010-3865: Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly…
PriorityP430high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.56%
42.4th percentile
Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | <= 2.6.36 | — |
| linux | linux_kernel | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_high_availability_extension | — | — |
| suse | linux_enterprise_real_time | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
CVE-2010-3865: NIST NVD Details: https://nvd
vendor_msrc·2020-09-08·CVSS 7.2
CVE-2010-3865 [HIGH] CVE-2010-3865: NIST NVD Details: https://nvd
NIST NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2010-3865
Mariner: Mariner
[email protected]: [email protected]
Exploit Status: DOS:N/A
Remediation: kernel
VMware
VMware ESX third party updates for Service Console packages glibc and dhcp
vendor_vmware·2011-10-12·CVSS 4.7
CVE-2010-0296 [MEDIUM] VMware ESX third party updates for Service Console packages glibc and dhcp
VMSA-2011-0012: VMware ESX third party updates for Service Console packages glibc and dhcp
a. ESX third party update for Service Console kernel This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CV
Ubuntu
Linux kernel (Maverick backport) vulnerabilities
vendor_ubuntu·2011-08-09·CVSS 4.9
CVE-2010-3698 [MEDIUM] Linux kernel (Maverick backport) vulnerabilities
Title: Linux kernel (Maverick backport) vulnerabilities
Summary: Multiple kernel flaws have been fixed.
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
Vasiliy Kulikov discovered that the Linux kernel sockets implementation
Ubuntu
Linux kernel vulnerabilities (i.MX51)
vendor_ubuntu·2011-07-06·CVSS 7.2
CVE-2010-4529 [HIGH] Linux kernel vulnerabilities (i.MX51)
Title: Linux kernel vulnerabilities (i.MX51)
Summary: Multiple kernel flaws have been fixed.
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate the size of certain buffers. A local attacker could
exploit this to crash the system or possibly execute arbitrary code as the
root user. (CVE-2010-3874)
Vasiliy Kulikov discovered that the
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-02·CVSS 4.9
CVE-2010-3698 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
Vasiliy Kulikov discovered that the Linux kernel sockets implementation did
not properly initialize certain
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-02·CVSS 7.2
CVE-2010-3865 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
Vasiliy Kulikov discovered that the Linux kernel sockets implementation did
not properly initialize certain structures. A local attacker could exploit
this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3876)
Vasiliy Kulikov discovered that the TIPC interface did not c
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-01·CVSS 7.2
CVE-2010-3865 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Thomas Pollet discovered that the RDS network protocol did not check
certain iovec buffers. A local attacker could exploit this to crash the
system or possibly execute arbitrary code as the root user. (CVE-2010-3865)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)
Vasiliy Kulikov discovered that the Linux kernel sockets implementation did
not properly initialize certain structures. A local attacker could exploit
this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3876)
Vasiliy Kulikov discovered that the TIPC interface did not c
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.6
CVE-2010-4078 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Jacobson discovered that ThinkPad video output was not correctly access
controlled. A local attacker could exploit this to hang the system, leading
to a denial of service. (CVE-2010-3448)
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local at
Red Hat
kernel: iovec integer overflow in net/rds/rdma.c
vendor_redhat·2010-10-29·CVSS 7.2
CVE-2010-3865 [HIGH] CWE-190 kernel: iovec integer overflow in net/rds/rdma.c
kernel: iovec integer overflow in net/rds/rdma.c
Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat
Enterprise MRG did not include support for the RDS Protocol, and therefore are
not affected by this issue. Future kernel updates in Red Hat Enterprise Linux 5
may address this flaw.
Mitigation: For users that do not run applications that use RDS, you can prevent the rds
module from being loaded by adding the following entry to the end of the
/etc/modprobe.d/blacklist file:
b
Red Hat
CVE-2010-4175: Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma
vendor_redhat·CVSS 7.2
CVE-2010-4175 [HIGH] CVE-2010-4175: Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma
Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma.c) in Linux kernel 2.6.35 allows local users to cause a denial of service (crash) and possibly trigger memory corruption via a crafted Reliable Datagram Sockets (RDS) request, a different vulnerability than CVE-2010-3865.
Statement: Not vulnerable. This issue did not affect the versions of the Linux kernel as
shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not include support for the RDS protocol. It did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6 as they did not backport the upstream commit eff5f53b that introduced this issue.
GHSA
GHSA-q9p3-383j-jvqg: Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma
ghsa_unreviewed·2022-05-17·CVSS 7.2
CVE-2010-4175 [HIGH] GHSA-q9p3-383j-jvqg: Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma
Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma.c) in Linux kernel 2.6.35 allows local users to cause a denial of service (crash) and possibly trigger memory corruption via a crafted Reliable Datagram Sockets (RDS) request, a different vulnerability than CVE-2010-3865.
GHSA
GHSA-qm3q-m933-m78g: Integer overflow in the rds_rdma_pages function in net/rds/rdma
ghsa_unreviewed·2022-05-13
CVE-2010-3865 [HIGH] CWE-190 GHSA-qm3q-m933-m78g: Integer overflow in the rds_rdma_pages function in net/rds/rdma
Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42789http://secunia.com/advisories/42801http://secunia.com/advisories/42890http://secunia.com/advisories/46397http://www.openwall.com/lists/oss-security/2010/10/29/1http://www.openwall.com/lists/oss-security/2010/11/01/1http://www.redhat.com/support/errata/RHSA-2011-0004.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.securityfocus.com/archive/1/520102/100/0/threadedhttp://www.securityfocus.com/bid/44549http://www.spinics.net/lists/netdev/msg145359.htmlhttp://www.spinics.net/lists/netdev/msg145397.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0012.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0024http://www.vupen.com/english/advisories/2011/0298https://exchange.xforce.ibmcloud.com/vulnerabilities/62881http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42789http://secunia.com/advisories/42801http://secunia.com/advisories/42890http://secunia.com/advisories/46397http://www.openwall.com/lists/oss-security/2010/10/29/1http://www.openwall.com/lists/oss-security/2010/11/01/1http://www.redhat.com/support/errata/RHSA-2011-0004.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.securityfocus.com/archive/1/520102/100/0/threadedhttp://www.securityfocus.com/bid/44549http://www.spinics.net/lists/netdev/msg145359.htmlhttp://www.spinics.net/lists/netdev/msg145397.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0012.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0024http://www.vupen.com/english/advisories/2011/0298https://exchange.xforce.ibmcloud.com/vulnerabilities/62881
2011-01-11
Published