Description

Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to version 11.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-21T18:16:51.657Z",
  "pubdate": "2026-08-21T18:16:51.657Z",
  "executiveSummary": "A vulnerability involving a missing privilege verification check has been identified in the secure context cleanup handler within FreeRTOS-Kernel before version 11.3.1. This flaw allows local users to trigger a use-after-free condition within secure-world memory by leveraging the SVC handler designated for secure context deallocation. The impact of this security deficiency includes potential memory corruption and unauthorized manipulation of secure-world memory regions. Affected systems are limited to deployments utilizing vulnerable versions of the FreeRTOS-Kernel where secure contexts are managed. The risk implication is significant as it compromises the isolation boundaries between secure and non-secure execution environments. Exploitation requires local access to the system and the ability to interact with the SVC handler for secure context management. Attackers must possess local execution capabilities to issue the malicious SVC calls required to trigger the improper deallocation sequence and subsequent use-after-free condition.",
  "technicalDetails": "The vulnerability resides in the secure context cleanup handler of the FreeRTOS-Kernel, specifically affecting versions prior to 11.3.1. The root cause of the issue is the absence of adequate privilege verification checks when processing secure context deallocation requests. In architectures implementing hardware security extensions, such as ARM TrustZone for ARMv8-M, secure contexts manage the state of tasks executing in the secure world. The vulnerable component is the SVC (Supervisor Call) handler responsible for secure context management and cleanup operations.\nExploitation of this vulnerability occurs when a local user or unprivileged task invokes the SVC handler designed for secure context deallocation without the necessary privilege validations being enforced by the kernel. Because the handler fails to verify whether the caller possesses the appropriate authorization to terminate or deallocate a specific secure context, a malicious local actor can issue a crafted SVC request. This request improperly releases or invalidates the secure-world memory associated with a secure context while references to that memory may still persist or be mishandled.\nThe attack flow proceeds as follows: First, the attacker establishes execution on the target system within a non-secure context or a less-privileged execution state. Second, the attacker formulates a targeted SVC payload designed to trigger the secure context deallocation routine. Third, the attacker invokes the vulnerable SVC handler. Fourth, due to the missing privilege verification, the kernel executes the deallocation logic without restricting the caller's authority. Fifth, this premature or unauthorized deallocation leaves dangling pointers or stale references to secure-world memory structures, resulting in a use-after-free condition.\nPost-exploitation impact includes the potential for arbitrary code execution within the secure world, bypass of hardware security boundaries, leakage of sensitive cryptographic material, or denial of service through system crashes induced by memory corruption. Authentication requirements are minimal beyond local execution access, and privilege requirements are bypassed due to the core authorization flaw in the handler. Network exposure is not a factor as the vulnerability is strictly local, exploitable entirely through software-triggered supervisor calls within the affected device."
}