Freertos
Monthly
DNS cache poisoning in Amazon FreeRTOS-Plus-TCP prior to V4.4.2 lets unauthenticated remote attackers insert an attacker-chosen address into a device's DNS cache by supplying a forged DNS reply that the resolver accepts before the legitimate response arrives. The flaw is an integrity-only weakness (CWE-940, improper verification of the source of a communication channel): the resolver does not adequately validate that a reply actually originated from the DNS server it queried, so a successful injection diverts subsequent outbound connections to attacker-controlled endpoints. Exploitation is constrained by high attack complexity - the attacker must match or guess reply-matching attributes such as source address/port and transaction ID and win a timing race - which favors on-path or local-network attackers over arbitrary internet senders; no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, and the vendor has released a fixed version with a required configuration flag.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Denial of service vulnerability in coreMQTT versions before 5.0.1 allows remote MQTT brokers to crash client applications through malformed MQTT v5.0 property packets. The vulnerability stems from missing bounds validation in the property parser, enabling out-of-bounds read conditions (CWE-125). Amazon Web Services has issued a security bulletin and released version 5.0.1 to address this issue.
FreeRTOS is a real-time operating system for microcontrollers. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow division by zero in prvCheckOptions. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
DNS cache poisoning in Amazon FreeRTOS-Plus-TCP prior to V4.4.2 lets unauthenticated remote attackers insert an attacker-chosen address into a device's DNS cache by supplying a forged DNS reply that the resolver accepts before the legitimate response arrives. The flaw is an integrity-only weakness (CWE-940, improper verification of the source of a communication channel): the resolver does not adequately validate that a reply actually originated from the DNS server it queried, so a successful injection diverts subsequent outbound connections to attacker-controlled endpoints. Exploitation is constrained by high attack complexity - the attacker must match or guess reply-matching attributes such as source address/port and transaction ID and win a timing race - which favors on-path or local-network attackers over arbitrary internet senders; no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, and the vendor has released a fixed version with a required configuration flag.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Denial of service vulnerability in coreMQTT versions before 5.0.1 allows remote MQTT brokers to crash client applications through malformed MQTT v5.0 property packets. The vulnerability stems from missing bounds validation in the property parser, enabling out-of-bounds read conditions (CWE-125). Amazon Web Services has issued a security bulletin and released version 5.0.1 to address this issue.
FreeRTOS is a real-time operating system for microcontrollers. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow division by zero in prvCheckOptions. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.