Skip to content

Improper input validation in FreeRTOS-Kernel timer command handling

High
kstribrnAmzn published GHSA-w3vr-pr75-5hc6 Aug 21, 2026

Package

FreeRTOS-Kernel

Affected versions

>=V7.0.0 AND <=V11.3.0

Patched versions

V11.3.1

Description

Summary

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors. On configurations that use the FreeRTOS MPU together with software timers, incomplete validation in the software timer command path lets an unprivileged task reach a privileged code path that is intended to be invoked only internally. As a result, an unprivileged task can cause the privileged timer service task to execute a caller-supplied function.

Impact

An unprivileged task can submit a timer command that the privileged timer service task later executes as a caller-supplied function call, resulting in arbitrary code execution in a privileged kernel context and bypassing MPU-enforced task isolation. This issue affects applications built with the FreeRTOS MPU and software timers enabled. Applications that do not use the FreeRTOS MPU are not affected.

Impacted versions: >=7.0.0 AND <=11.3.0 (MPU-enabled ports)

Patches

This issue has been addressed in FreeRTOS-Kernel version V11.3.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no risk when not using software timers. If using software timers, upgrading to the fixed version is the recommended remediation.

References

If you have any questions or comments about this advisory, please reach out to AWS Security via https://aws.amazon.com/security/vulnerability-reporting/ or email aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

We would like to thank NVIDIA (Project Vanessa) for collaborating on this issue through the coordinated vulnerability disclosure process.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE ID

CVE-2026-77234

Weaknesses

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. Learn more on MITRE.