high
7
CWE
843
Advisory Published
Updated

CVE-2023-1077

First published: Mon Mar 27 2023(Updated: )

In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.

Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Linux Kernel>=2.6.25<4.19.293
Linux Kernel>=4.20<5.4.235
Linux Kernel>=5.5<5.10.173
Linux Kernel>=5.11<5.15.99
Linux Kernel>=5.16<6.1.16
Linux Kernel>=6.2<6.2.3
Debian Linux=10.0
All of
NetApp AFF A700s Firmware
NetApp A700
All of
NetApp AFF 8300 Firmware
NetApp FAS8300
All of
NetApp AFF 8700 Firmware
NetApp FAS8700
All of
NetApp AFF A400 Firmware
NetApp FAS A400
All of
NetApp C400
NetApp C400 Firmware
All of
NetApp H300S Firmware
NetApp H300S Firmware
All of
NetApp H500e Firmware
NetApp H500e Firmware
All of
NetApp H700S
NetApp H700S
All of
NetApp H410S
NetApp H410S Firmware
All of
NetApp H410C
NetApp H410C Firmware
Linux Kernel
NetApp AFF A700s Firmware
NetApp A700
NetApp AFF 8300 Firmware
NetApp FAS8300
NetApp AFF 8700 Firmware
NetApp FAS8700
NetApp AFF A400 Firmware
NetApp FAS A400
NetApp C400
NetApp C400 Firmware
NetApp H300S Firmware
NetApp H300S Firmware
NetApp H500e Firmware
NetApp H500e Firmware
NetApp H700S
NetApp H700S
NetApp H410S
NetApp H410S Firmware
NetApp H410C
NetApp H410C Firmware
debian/linux
5.10.223-1
5.10.234-1
6.1.129-1
6.1.128-1
6.12.20-1
6.12.21-1

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2023-1077?

    CVE-2023-1077 is classified as a high-severity vulnerability due to the potential for type confusion in the Linux kernel.

  • How do I fix CVE-2023-1077?

    To mitigate CVE-2023-1077, update the Linux kernel to any of the following fixed versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.

  • Which versions of the Linux kernel are affected by CVE-2023-1077?

    CVE-2023-1077 affects Linux kernel versions between 2.6.25 and 4.19.293, and also 4.20 to 5.4.235, 5.5 to 5.10.173, 5.11 to 5.15.99, 5.16 to 6.1.16, and 6.2 to 6.2.3.

  • What component of the Linux kernel is affected by CVE-2023-1077?

    CVE-2023-1077 specifically affects the function pick_next_rt_entity() in the Linux kernel.

  • Is there a workaround for CVE-2023-1077 if I cannot update my kernel?

    There are currently no effective workarounds for CVE-2023-1077; updating the kernel is the recommended solution.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203