Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
BID:44219
Info
Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
| Bugtraq ID: | 44219 |
| Class: | Design Error |
| CVE: |
CVE-2010-3904 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 19 2010 12:00AM |
| Updated: | Apr 13 2015 09:16PM |
| Credit: | Dan Rosenberg |
| Vulnerable: |
VMWare ESX 4.1 VMWare ESX 4.0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Real Time 11 SP1 SuSE SUSE Linux Enterprise High Availability Extension 11 SP1 SuSE SUSE Linux Enterprise High Availability Extension 11 SuSE Suse Linux Enterprise Desktop 11 SP1 SuSE Suse Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 11 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server OpenFabrics Alliance OpenFabrics Enterprise Distribution (OFED) 1.5.2 Linux kernel 2.6.35 Linux kernel 2.6.34 Linux kernel 2.6.33 .1 Linux kernel 2.6.33 Linux kernel 2.6.32 .9 Linux kernel 2.6.32 Linux kernel 2.6.31 5 Linux kernel 2.6.31 13 Linux kernel 2.6.31 .2 Linux kernel 2.6.31 .11 Linux kernel 2.6.31 -rc7 Linux kernel 2.6.31 -rc6 Linux kernel 2.6.31 -rc3 Linux kernel 2.6.31 -rc1 Linux kernel 2.6.31 Linux kernel 2.6.30 .10 Linux kernel 2.6.30 .1 Linux kernel 2.6.30 Linux kernel 2.6.36-rc8 Linux kernel 2.6.36-rc6 Linux kernel 2.6.36-rc5 Linux kernel 2.6.36-rc4 Linux kernel 2.6.36-rc1 Linux kernel 2.6.35.5 Linux kernel 2.6.35.4 Linux kernel 2.6.35.1 Linux kernel 2.6.35-rc6 Linux kernel 2.6.35-rc5-git5 Linux kernel 2.6.35-rc5 Linux kernel 2.6.35-rc4 Linux kernel 2.6.35-rc1 Linux kernel 2.6.34.3 Linux kernel 2.6.34.2 Linux kernel 2.6.34.1 Linux kernel 2.6.34-rc6 Linux kernel 2.6.34-rc5 Linux kernel 2.6.34-rc4 Linux kernel 2.6.34-rc2-git1 Linux kernel 2.6.34-rc2 Linux kernel 2.6.34-rc1 Linux kernel 2.6.33.7 Linux kernel 2.6.33-rc8 Linux kernel 2.6.33-rc7 Linux kernel 2.6.33-rc7 Linux kernel 2.6.33-rc6-git5 Linux kernel 2.6.33-rc6 Linux kernel 2.6.33-rc5 Linux kernel 2.6.33-rc4 Linux kernel 2.6.33-rc1 Linux kernel 2.6.32.8 Linux kernel 2.6.32.7 Linux kernel 2.6.32.6 Linux kernel 2.6.32.5 Linux kernel 2.6.32.4 Linux kernel 2.6.32.3 Linux kernel 2.6.32.22 Linux kernel 2.6.32.2 Linux kernel 2.6.32.18 Linux kernel 2.6.32.17 Linux kernel 2.6.32.16 Linux kernel 2.6.32.15 Linux kernel 2.6.32.14 Linux kernel 2.6.32.13 Linux kernel 2.6.32.12 Linux kernel 2.6.32.11 Linux kernel 2.6.32.10 Linux kernel 2.6.32.1 Linux kernel 2.6.32-rc8 Linux kernel 2.6.32-rc7 Linux kernel 2.6.32-rc5 Linux kernel 2.6.32-rc4 Linux kernel 2.6.32-rc3 Linux kernel 2.6.32-rc2 Linux kernel 2.6.32-rc1 Linux kernel 2.6.31.6 Linux kernel 2.6.31.4 Linux kernel 2.6.31.1 Linux kernel 2.6.31-rc9 Linux kernel 2.6.31-rc8 Linux kernel 2.6.31-rc5-git3 Linux kernel 2.6.31-rc4 Linux kernel 2.6.31-rc2 Linux kernel 2.6.31-git11 Linux kernel 2.6.30.5 Linux kernel 2.6.30.4 Linux kernel 2.6.30.3 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya IQ 5.1 Avaya IQ 5 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1 Avaya Aura System Platform 1.0 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Communication Manager 5.2 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 |
| Not Vulnerable: | |
Discussion
Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
The Linux kernel is prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will cause a denial-of-service condition.
Linux kernel 2.6.30 through 2.6.36-rc8 are vulnerable.
The Linux kernel is prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will cause a denial-of-service condition.
Linux kernel 2.6.30 through 2.6.36-rc8 are vulnerable.
Exploit / POC
Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 10.04 powerpc
S.u.S.E. openSUSE 11.2
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 10.04 powerpc
-
Ubuntu linux-headers-2.6.35-25_2.6.35-25.44~lucid1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/l/linux-lts-backport-maver ick/linux-headers-2.6.35-25_2.6.35-25.44~lucid1_all.deb
S.u.S.E. openSUSE 11.2
-
SuSE kernel-debug-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-debug-2.6.31. 14-0.4.1.i586.rpm -
SuSE kernel-debug-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-debug-2.6.3 1.14-0.4.1.x86_64.rpm -
SuSE kernel-debug-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-debug-base-2. 6.31.14-0.4.1.i586.rpm -
SuSE kernel-debug-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-debug-base- 2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-debug-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-debug-devel-2 .6.31.14-0.4.1.i586.rpm -
SuSE kernel-debug-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-debug-devel -2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-default-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-default-2.6.3 1.14-0.4.1.i586.rpm -
SuSE kernel-default-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-default-2.6 .31.14-0.4.1.x86_64.rpm -
SuSE kernel-default-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-default-base- 2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-default-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-default-bas e-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-default-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-default-devel -2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-default-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-default-dev el-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-desktop-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-desktop-2.6.3 1.14-0.4.1.i586.rpm -
SuSE kernel-desktop-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-desktop-2.6 .31.14-0.4.1.x86_64.rpm -
SuSE kernel-desktop-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-desktop-base- 2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-desktop-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-desktop-bas e-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-desktop-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-desktop-devel -2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-desktop-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-desktop-dev el-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-pae-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-pae-2.6.31.14 -0.4.1.i586.rpm -
SuSE kernel-pae-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-pae-base-2.6. 31.14-0.4.1.i586.rpm -
SuSE kernel-pae-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-pae-devel-2.6 .31.14-0.4.1.i586.rpm -
SuSE kernel-source-2.6.31.14-0.4.1.noarch.rpm
http://download.opensuse.org/update/11.2/rpm/noarch/kernel-source-2.6. 31.14-0.4.1.noarch.rpm -
SuSE kernel-source-vanilla-2.6.31.14-0.4.1.noarch.rpm
http://download.opensuse.org/update/11.2/rpm/noarch/kernel-source-vani lla-2.6.31.14-0.4.1.noarch.rpm -
SuSE kernel-syms-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-syms-2.6.31.1 4-0.4.1.i586.rpm -
SuSE kernel-syms-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-syms-2.6.31 .14-0.4.1.x86_64.rpm -
SuSE kernel-trace-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-trace-2.6.31. 14-0.4.1.i586.rpm -
SuSE kernel-trace-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-trace-2.6.3 1.14-0.4.1.x86_64.rpm -
SuSE kernel-trace-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-trace-base-2. 6.31.14-0.4.1.i586.rpm -
SuSE kernel-trace-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-trace-base- 2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-trace-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-trace-devel-2 .6.31.14-0.4.1.i586.rpm -
SuSE kernel-trace-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-trace-devel -2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-vanilla-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-vanilla-2.6.3 1.14-0.4.1.i586.rpm -
SuSE kernel-vanilla-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-vanilla-2.6 .31.14-0.4.1.x86_64.rpm -
SuSE kernel-vanilla-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-vanilla-base- 2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-vanilla-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-vanilla-bas e-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-vanilla-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-vanilla-devel -2.6.31.14-0.4.1.i586.rpm -
SuSE kernel-vanilla-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-vanilla-dev el-2.6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-xen-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-xen-2.6.31.14 -0.4.1.i586.rpm -
SuSE kernel-xen-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-xen-2.6.31. 14-0.4.1.x86_64.rpm -
SuSE kernel-xen-base-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-xen-base-2.6. 31.14-0.4.1.i586.rpm -
SuSE kernel-xen-base-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-xen-base-2. 6.31.14-0.4.1.x86_64.rpm -
SuSE kernel-xen-devel-2.6.31.14-0.4.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/kernel-xen-devel-2.6 .31.14-0.4.1.i586.rpm -
SuSE kernel-xen-devel-2.6.31.14-0.4.1.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/kernel-xen-devel-2 .6.31.14-0.4.1.x86_64.rpm -
SuSE preload-kmp-default-1.1_2.6.31.14_0.4-6.9.32.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/preload-kmp-default- 1.1_2.6.31.14_0.4-6.9.32.i586.rpm -
SuSE preload-kmp-default-1.1_2.6.31.14_0.4-6.9.32.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/preload-kmp-defaul t-1.1_2.6.31.14_0.4-6.9.32.x86_64.rpm -
SuSE preload-kmp-desktop-1.1_2.6.31.14_0.4-6.9.32.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/preload-kmp-desktop- 1.1_2.6.31.14_0.4-6.9.32.i586.rpm -
SuSE preload-kmp-desktop-1.1_2.6.31.14_0.4-6.9.32.x86_64.rpm
http://download.opensuse.org/update/11.2/rpm/x86_64/preload-kmp-deskto p-1.1_2.6.31.14_0.4-6.9.32.x86_64.rpm
References
Linux Kernel Reliable Datagram Sockets (RDS) Protocol Local Privilege Escalation Vulnerability
References:
References:
- CVE Clarification: OpenFabrics ofed stack also contains RDS protocol (Marcus Meissner)
- De-pessimize rds_page_copy_user (Linus Torvalds)
- Linux Homepage (Linux)
- Linux RDS Protocol Local Privilege Escalation (Dan Rosenberg)
- OpenFabrics Alliance Homepage (OpenFabrics Alliance)
- USN-1000-1: Linux kernel vulnerabilities (Ubuntu)
- Re: VSR Advisories: Linux RDS Protocol Local Privilege Escalation (Dan Rosenberg
- ASA-2010-327 kernel security update (RHSA-2010-0792) (Avaya)