HOMEVULNERABILITIESCVE-2023-1077
HIGH

CVE-2023-1077

CWE-843Published: March 27, 2023· Updated: Jun 17, 2026

7.0
CVSS v3.1

Official Description

In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.

NVD Source

Technical Analysis

CVE-2023-1077 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.0.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityHigh
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Debian1 product(s)
debian linux
Linux1 product(s)
linux kernel
netapp20 product(s)
a700s firmwarea700s8300 firmware83008700 firmware8700a400 firmwarea400c400 firmwarec400h300s firmwareh300s+8
Source: NVD CPE · 22 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97
PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97
ADVISORYhttps://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
ADVISORYhttps://security.netapp.com/advisory/ntap-20230511-0002/
ADVISORYhttps://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
ADVISORYhttps://security.netapp.com/advisory/ntap-20230511-0002/

All References (8)

→
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97Mailing List · Patch
→
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List · Third Party Advisory
→
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlMailing List
→
https://security.netapp.com/advisory/ntap-20230511-0002/Third Party Advisory
→
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97Mailing List · Patch
→
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List · Third Party Advisory
→
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlMailing List
→
https://security.netapp.com/advisory/ntap-20230511-0002/Third Party Advisory

Quick Facts

CVE IDCVE-2023-1077
CVSS Score7.0 / 10
SeverityHIGH
WeaknessCWE-843
CISA KEVNo
Affected3 vendor(s)
PublishedMar 27, 2023

Related CVEs (CWE-843)

CVE-2021-33970
10.0
CVE-2010-2299
10.0
CVE-2019-10231
9.8
CVE-2019-14537
9.8
CVE-2019-2130
9.8
CVE-2025-47151
9.8

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2023-1077 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2023-1077·NVD