Linux Kernel Improper Input Validation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-05-12
• EPSS: 16% chance of exploitation in the next 30 days (higher than 97% of CVEs)

[ Description ]Official description

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

CISA: Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 2 Jun 2023): The impacted product is end-of-life and should be disconnected if still in use.

• Patch on bugzilla.redhat.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• git.kernel.orgBroken Link
• lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlMailing ListThird Party Advisory
• packetstormsecurity.com/files/155751/vReliable-Datagram-Sockets-RDS-rds_page_copy_user-…ExploitThird Party AdvisoryVDB Entry
• secunia.com/advisories/46397Broken LinkThird Party Advisory
• securitytracker.com/idBroken LinkThird Party AdvisoryVDB Entry
• www.kb.cert.org/vuls/id/362983Third Party AdvisoryUS Government Resource
• www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36Broken Link
• www.redhat.com/support/errata/RHSA-2010-0792.htmlBroken LinkThird Party Advisory
• www.redhat.com/support/errata/RHSA-2010-0842.htmlBroken LinkThird Party Advisory
• www.securityfocus.com/archive/1/520102/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
• www.ubuntu.com/usn/USN-1000-1Third Party Advisory
• www.vmware.com/security/advisories/VMSA-2011-0012.htmlThird Party Advisory
• www.vsecurity.com/download/tools/linux-rds-exploit.cBroken Link
• www.vsecurity.com/resources/advisory/20101019-1Broken Link
• www.vupen.com/english/advisories/2011/0298Broken LinkThird Party Advisory
• bugzilla.redhat.com/show_bug.cgiIssue TrackingPatchThird Party Advisory
• www.exploit-db.com/exploits/44677ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource