Description

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T18:16:51.507Z",
  "pubdate": "2026-08-21T18:16:51.507Z",
  "executiveSummary": "An improper input validation vulnerability has been identified in the FreeRTOS-Kernel prior to version 11.3.1. This vulnerability exists within Memory Protection Unit (MPU) enabled ports and affects systems utilizing the FreeRTOS-Kernel.\nThe primary impact of this security flaw is privilege escalation, allowing an unprivileged task to successfully execute arbitrary code within the privileged kernel context.\nThe risk implications are severe, as compromising the kernel context undermines the hardware isolation boundaries enforced by the MPU, potentially granting the attacker complete control over the compromised device.\nAttacker capabilities require the execution of an unprivileged task within the system environment, meaning an attacker must already have local code execution context or the ability to inject an unprivileged task.\nExploitation requirements include targeting MPU-enabled ports where input validation routines fail to properly sanitize or verify data passed from the unprivileged execution domain to the privileged kernel boundary.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation logic within the FreeRTOS-Kernel for MPU-enabled ports prior to version 11.3.1.\nThe affected components are the boundary-crossing mechanisms and system services that handle data exchanges between unprivileged tasks and privileged kernel routines.\nAffected versions include all FreeRTOS-Kernel releases prior to version 11.3.1.\nAuthentication requirements are internal to the system architecture; no external authentication is bypassed, but the execution relies on the presence of an active, unprivileged task.\nPrivilege requirements are minimal for the initial vector, requiring only an unprivileged task context, while the post-exploitation privilege level reaches the fully privileged kernel context.\nNetwork exposure is not directly applicable to this local MPU isolation vulnerability, though the underlying task could theoretically be fed malicious input via network peripherals if exposed.\nThe attack flow proceeds as follows: First, an attacker establishes or controls an unprivileged task executing on an MPU-enabled port. Second, the unprivileged task supplies maliciously crafted inputs or parameters designed to exploit the improper input validation checks during a kernel service invocation. Third, due to the lack of sufficient validation, the kernel fails to reject the malformed input or boundary violation. Finally, the flaw allows the execution flow to pivot, leading to the execution of arbitrary instructions within the privileged kernel context, effectively bypassing MPU memory isolation guarantees.\nPost-exploitation impact includes total compromise of the real-time operating system kernel, disabling security domain separation, arbitrary memory read and write capabilities across the entire address space, and potential manipulation of hardware peripherals managed by the kernel."
}