CVE-2023-1077

NameCVE-2023-1077
DescriptionIn the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3404-1, DLA-3710-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)buster4.19.249-2vulnerable
buster (security)4.19.304-1fixed
bullseye5.10.209-2fixed
bullseye (security)5.10.205-2fixed
bookworm6.1.76-1fixed
bookworm (security)6.1.69-1fixed
trixie, sid6.6.15-2fixed
linux-5.10 (PTS)buster (security)5.10.209-2~deb10u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebuster4.19.304-1DLA-3710-1
linuxsourcebullseye5.10.178-1
linuxsource(unstable)6.1.20-1
linux-5.10sourcebuster5.10.178-3~deb10u1DLA-3404-1

Notes

https://git.kernel.org/linus/7c4a5b89a0b5a57a64b601775b296abf77a9fe97
https://www.openwall.com/lists/oss-security/2023/03/01/7

Search for package or bug name: Reporting problems