CVE-2023-1077: High severity linux kernel vulnerability
In the Linux kernel, picknextrtentity() may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused schedrtentity,causing memory corruption.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1077?
CVE-2023-1077 is classified as a high-severity vulnerability due to the potential for type confusion in the Linux kernel.
How do I fix CVE-2023-1077?
To mitigate CVE-2023-1077, update the Linux kernel to any of the following fixed versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which versions of the Linux kernel are affected by CVE-2023-1077?
CVE-2023-1077 affects Linux kernel versions between 2.6.25 and 4.19.293, and also 4.20 to 5.4.235, 5.5 to 5.10.173, 5.11 to 5.15.99, 5.16 to 6.1.16, and 6.2 to 6.2.3.
What component of the Linux kernel is affected by CVE-2023-1077?
CVE-2023-1077 specifically affects the function pick_next_rt_entity() in the Linux kernel.
Is there a workaround for CVE-2023-1077 if I cannot update my kernel?
There are currently no effective workarounds for CVE-2023-1077; updating the kernel is the recommended solution.