Exploited· due 2023-06-02
CVE-2010-3904
Linux Kernel
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Exploitation status
- CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
- US federal civilian agencies are required to remediate it by 2023-06-02. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
Required action
The impacted product is end-of-life and should be disconnected if still in use.
CISA’s wording, unedited.
Scoring
- CVSS
- Not yet scored
Dates
- Published
- 2023-05-12
- Added to KEV
- 2023-05-12
- Remediation due
- 2023-06-02
- Sources
- CISA KEV