High · published March 28, 2023
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.25, < 4.19.293 | 4.19.293 |
| linux/linux_kernel | ≥ 4.20, < 5.4.235 | 5.4.235 |
| linux/linux_kernel | ≥ 5.5, < 5.10.173 | 5.10.173 |
| linux/linux_kernel | ≥ 5.11, < 5.15.99 | 5.15.99 |
| linux/linux_kernel | ≥ 5.16, < 6.1.16 | 6.1.16 |
| linux/linux_kernel | ≥ 6.2, < 6.2.3 | 6.2.3 |
| debian/debian_linux | all versions | — |
| netapp/a700s_firmware | all versions | — |
| netapp/8300_firmware | all versions | — |
| netapp/8700_firmware | all versions | — |
| netapp/a400_firmware | all versions | — |
| netapp/c400_firmware | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h410c_firmware | all versions | — |