cbcvebase.
CVE-2010-3904
published 2010-12-06

CVE-2010-3904: The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not…

PriorityP182high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-06-02
Exploited in the wild
EPSS
12.16%
95.7th percentile
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Affected

21 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
linuxlinux_kernel< 2.6.362.6.36
opensuseopensuse
opensuseopensuse
redhatenterprise_linux
redhatenterprise_linux
suselinux_enterprise_desktop
suselinux_enterprise_real_time_extension
suselinux_enterprise_server
vmwareesxi
vmwareesxi
vmwareesxi
vmwareesxi
vmwarevmware_esxi
vmwarevmware_workstation
vmwarevsphere

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://vulnfactory.org/exploits/rds-fail.c
urlhttp://web.archive.org/web/20101020044048/http://www.vsecurity.com/download/tools/linux-rds-exploit.c
urlhttp://www.vsecurity.com/download/tools/linux-rds-exploit.c
filenamerds-fail.c
filenamerds-fail.x64
filenamerds-fail.x86
pathnet/rds/page.c
commandecho "alias net-pf-21 off" > /etc/modprobe.d/disable-rds
processsocket(PF_RDS, SOCK_SEQPACKET, 0)
  • Alert on reads of /proc/kallsyms or /boot/System.map-<release> by unprivileged processes — the exploit resolves kernel symbols (security_ops, default_security_ops, cap_ptrace_traceme, commit_creds, prepare_kernel_cred) as a prerequisite step.
  • Check whether the rds kernel module is loaded on hosts running Linux kernel 2.6.30–2.6.36; its presence on non-RDS workloads is a strong indicator of exploitation risk or active exploitation.
  • The exploit uses RDS UDP-like sockets on source port 6666 (SENDPORT) and destination port 5555 (RECVPORT) on loopback; local socket activity on these ports from unexpected processes should be investigated.
  • Metasploit module drops a randomly named hidden executable (dot-prefixed alphanumeric name) into WritableDir (/tmp by default) and a separate payload executable; monitor for hidden executables created in /tmp followed by privilege escalation.
  • ·Vulnerable kernel range is 2.6.30 to 2.6.36-rc8 only; kernels outside this range (including RHEL 3/4/MRG which never shipped RDS support) are not affected.
  • ·The exploit checks /proc/sys/kernel/modules_disabled; if module loading is disabled AND rds is not already loaded, the exploit will fail — detection should account for pre-loaded rds module scenarios.
  • ·Blacklisting the rds module via /etc/modprobe.d/blacklist or aliasing net-pf-21 to off prevents accidental loading and blocks the exploit without a reboot, but only if the module is not already loaded.
  • ·The Metasploit module defaults to PAYLOAD linux/x86/meterpreter/reverse_tcp with PrependFork enabled and WfsDelay of 10 seconds; defenders should tune reverse-shell detection accordingly.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.