Freertos Kernel
Monthly
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the assigned CVSS 4.0 score of 9.3 reflects the complete compromise of the affected system once a foothold task exists.