CVE-2023-1077 Memory corruption in Linux kernel
A type confusion flaw in the Linux kernel scheduler can lead to memory corruption, potentially allowing local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1077?
CVE-2023-1077 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 27 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
Weakness: CWE-843
Which versions are affected by CVE-2023-1077?
It affects 12 products.
Products include Debian Debian Linux, Linux kernel, Netapp 8300 Firmware, Netapp 8700 Firmware, Netapp A400 Firmware, Netapp A700s Firmware and 6 more.
How do I fix CVE-2023-1077?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-1077 being exploited?
There is no known exploitation of CVE-2023-1077 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-1077, GHSA-gqqh-295f-w7wc, UBUNTU-CVE-2023-1077.