CVE-2010-3904

Linux Kernel contains an improper input validation flaw (CWE-20) in its Reliable Datagram Sockets (RDS) protocol implementation, which mishandles data passed through the sendmsg and recvmsg system calls. A local user who can create an RDS socket and issue crafted sendmsg/recvmsg calls triggers the flaw and corrupts kernel memory. Successful exploitation yields local privilege escalation, allowing an unprivileged user to execute code with elevated (root) privileges. Any Linux system whose kernel includes RDS support is affected, though specific version ranges are not provided in the available data, and exploitation requires an attacker to already have some local foothold on the machine. CISA added CVE-2010-3904 to the Known Exploited Vulnerabilities catalog on 2023-05-12, confirming active exploitation (ransomware use unknown); EPSS estimates a 14.6% probability of exploitation in the next 30 days (96th percentile), and no public proof-of-concept is catalogued.

What to do: Install your distribution's updated kernel packages containing the RDS input-validation fix (vendors have long backported this patch) and reboot into the patched kernel. Verify whether RDS is present and loadable (e.g., check 'lsmod | grep rds' and /proc/net/rds) and restrict unprivileged local shell access, since exploitation requires local code execution. Per CISA's KEV required action, the impacted product is end-of-life, so disconnect or decommission systems still running unpatched/EOL kernels, and monitor for Linux-targeting campaigns such as UAT-10147, which deploys EDR bypass and Linux rootkits that pair naturally with local privilege escalation flaws.