Description

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-21T18:16:51.800Z",
  "pubdate": "2026-08-21T18:16:51.800Z",
  "executiveSummary": "A vulnerability involving missing minimum size validation in secure context allocation has been identified in FreeRTOS-Kernel before version 11.3.1. This security flaw enables local users to corrupt secure-world heap metadata via an out-of-bounds write primitive triggered by supplying an undersized stack size parameter during secure context initialization. The primary impact of this vulnerability is the potential corruption of critical secure-world memory structures, which can lead to arbitrary code execution, privilege escalation, or denial of service within the secure execution environment.\nThe affected product is FreeRTOS-Kernel in versions prior to 11.3.1. Risk implications are significant for embedded systems utilizing hardware-isolated secure worlds, as compromise of the secure-world heap undermines the integrity of the entire Trusted Execution Environment (TEE).\nTo successfully exploit this vulnerability, an attacker requires local execution capabilities and the ability to interact with the secure context allocation interfaces. The exploitation mechanism relies on the lack of boundary checks on the stack size parameter, allowing an undersized allocation request to bypass safety controls and precipitate subsequent memory corruption during write operations.",
  "technicalDetails": "The root cause of the vulnerability resides in the secure context allocation logic within the FreeRTOS-Kernel codebase prior to version 11.3.1. Specifically, the subsystem fails to enforce a validation check for the minimum allowable size of a secure context stack parameter before committing heap resources and performing memory mapping operations.\nThe vulnerable component is the secure context allocation mechanism responsible for managing memory allocations within the secure-world heap. Affected versions comprise all releases of FreeRTOS-Kernel prior to 11.3.1. The vulnerability does not require complex network exposure, as it is fundamentally a local privilege escalation and memory corruption vector inherent to the internal API or system call boundary handling.\nThe attack flow proceeds as follows: First, a local user or compromised application thread invokes the secure context allocation function. Second, the caller supplies a maliciously crafted, undersized stack size parameter. Third, because the allocation routine lacks adequate minimum size validation, it allocates a buffer that is insufficient to safely handle expected operational offsets or metadata tracking requirements. Fourth, subsequent write operations utilizing this undersized allocation exceed the allocated buffer boundaries, resulting in an out-of-bounds write condition.\nThis out-of-bounds write directly targets and overwrites adjacent secure-world heap metadata, such as chunk headers, size descriptors, or pointers used by the memory allocator. Post-exploitation impact includes the manipulation of control flow data, corruption of critical secure state variables, or destabilization of the secure-world runtime environment, ultimately granting the local adversary unauthorized control over secure execution contexts."
}