Summary
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors. On configurations that use the FreeRTOS MPU together with software timers, incomplete validation in the software timer command path lets an unprivileged task reach a privileged code path that is intended to be invoked only internally. As a result, an unprivileged task can cause the privileged timer service task to execute a caller-supplied function.
Impact
An unprivileged task can submit a timer command that the privileged timer service task later executes as a caller-supplied function call, resulting in arbitrary code execution in a privileged kernel context and bypassing MPU-enforced task isolation. This issue affects applications built with the FreeRTOS MPU and software timers enabled. Applications that do not use the FreeRTOS MPU are not affected.
Impacted versions: >=7.0.0 AND <=11.3.0 (MPU-enabled ports)
Patches
This issue has been addressed in FreeRTOS-Kernel version V11.3.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
There is no risk when not using software timers. If using software timers, upgrading to the fixed version is the recommended remediation.
References
If you have any questions or comments about this advisory, please reach out to AWS Security via https://aws.amazon.com/security/vulnerability-reporting/ or email aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
We would like to thank NVIDIA (Project Vanessa) for collaborating on this issue through the coordinated vulnerability disclosure process.
Summary
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors. On configurations that use the FreeRTOS MPU together with software timers, incomplete validation in the software timer command path lets an unprivileged task reach a privileged code path that is intended to be invoked only internally. As a result, an unprivileged task can cause the privileged timer service task to execute a caller-supplied function.
Impact
An unprivileged task can submit a timer command that the privileged timer service task later executes as a caller-supplied function call, resulting in arbitrary code execution in a privileged kernel context and bypassing MPU-enforced task isolation. This issue affects applications built with the FreeRTOS MPU and software timers enabled. Applications that do not use the FreeRTOS MPU are not affected.
Impacted versions: >=7.0.0 AND <=11.3.0 (MPU-enabled ports)
Patches
This issue has been addressed in FreeRTOS-Kernel version V11.3.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
There is no risk when not using software timers. If using software timers, upgrading to the fixed version is the recommended remediation.
References
If you have any questions or comments about this advisory, please reach out to AWS Security via https://aws.amazon.com/security/vulnerability-reporting/ or email aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
We would like to thank NVIDIA (Project Vanessa) for collaborating on this issue through the coordinated vulnerability disclosure process.