Freertos Kernel
Monthly
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.