UpHeron
All vulnerabilities

Servers and applications

CVE-2010-3904

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 12 May 2023.

Severity
High 7.8
Published
6 Dec 2010
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
16% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
CWE-1284
Attack
Needs local access · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
VMware ESXiServers and applications · cpe:o:vmware:esxi
  • Version 3.5
  • Version 4.0
  • Version 4.1
  • Version 5.0

Known exploited

CISA name
Linux Kernel Improper Input Validation Vulnerability
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Due for US agencies
2 Jun 2023
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2010-3904
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2010-3904