Description
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.7.1.el6 | RHSA-2010:0842 |
| RHEL 5 | kernel +12 | 2.6.18-194.17.4.el5 | RHSA-2010:0792 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation
exploit/linux/local/rds_rds_page_copy_user_priv_esc
Exploit-DB 2
- Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit) EDB-44677 · local · May 21, 2018 · verified
- Linux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation EDB-15285 · local · Oct 19, 2010 · verified
GitHub 1 repository
-
redhatkaty/-cve-2010-3904-report ★ 0 · Jun 9, 2015
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2010:0842 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0792 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- VU#362983 third-party-advisory
- http://www.vsecurity.com/download/tools/linux-rds-exploit.c
- USN-1000-1 vendor-advisory
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- 46397 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=799c10559d60f159ab2232203f222f18fa3c4a5f
- 44677 exploit
- 1024613 vdb-entry
- SUSE-SA:2011:007 vendor-advisory
- RHSA-2010:0842 vendor-advisory
- ADV-2011-0298 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=642896
- SUSE-SA:2010:057 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36
- http://www.vsecurity.com/resources/advisory/20101019-1/
- RHSA-2010:0792 vendor-advisory
- SUSE-SA:2010:053 vendor-advisory
- http://packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-Privilege-Escalation.html