Linux Kernel Improper Input Validation Vulnerability (CVE-2010-3904)
Severity: high · Patch status: unpatched · Since 2023-05-12 · CVE-2010-3904
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. CISA added CVE-2010-3904 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.
What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- US federal agencies must remediate by Jun 2, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
