FreeRTOS Kernel Vulnerable to Local Privilege Escalation via Return Oriented Programming

CVE-2024-28115

What is CVE-2024-28115?

The FreeRTOS Kernel, a widely used real-time operating system for microcontrollers created by Amazon, has a vulnerability that enables local privilege escalation via Return Oriented Programming techniques. This issue is primarily relevant for versions of the FreeRTOS Kernel up to 10.6.1, specifically affecting ARMv7-M MPU ports and ARMv8-M ports with Memory Protection Unit (MPU) features enabled. If a vulnerability permits code injection, an attacker could exploit this to execute unauthorized code within the system. Amazon has addressed this issue in FreeRTOS Kernel version 10.6.2, introducing a new MPU wrapper to enhance security.

References