Description

Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T18:16:51.950Z",
  "pubdate": "2026-08-21T18:16:51.950Z",
  "executiveSummary": "A vulnerability exists in the FreeRTOS-Kernel prior to version 11.3.1 involving missing queue-set type validation within the xQueueAddToSet() function.\nThis flaw can allow an unprivileged task operating on Memory Protection Unit (MPU) enabled ports, when configured with configUSE_QUEUE_SETS=1, to read privileged kernel memory.\nThe risk implication is a potential breach of kernel memory isolation, allowing unauthorized access to sensitive data structures maintained by the operating system.\nThe attacker capabilities require execution context within an unprivileged task on a targeted MPU-enabled system configuration where queue sets are actively utilized.\nExploitation requirements include local code execution within the constrained environment of a lower-privileged task and specific kernel configuration parameters, namely configUSE_QUEUE_SETS set to 1.\nRemediation requires upgrading the FreeRTOS-Kernel to version 11.3.1 or later to ensure proper type validation checks are enforced during queue set operations.",
  "technicalDetails": "The vulnerability stems from the absence of rigorous type validation checks within the xQueueAddToSet() function of the FreeRTOS-Kernel.\nSpecifically, when configUSE_QUEUE_SETS=1 is enabled, the kernel facilitates the grouping of multiple queues and semaphores into a single set to block or pend on multiple objects simultaneously.\nIn MPU-enabled ports, strict memory protection boundaries are designed to isolate privileged kernel space from unprivileged task execution spaces.\nDue to the missing validation logic in xQueueAddToSet(), an unprivileged task can manipulate queue set structures in an unintended manner.\nThe attack flow proceeds as follows: an unprivileged task interacts with the kernel API function xQueueAddToSet() by passing maliciously crafted or improperly validated parameters or references.\nBecause the vulnerable component fails to adequately verify the underlying type and permissions associated with the queue-set elements, the kernel processes the operation without enforcing strict access controls.\nConsequently, this permits the unprivileged execution context to bypass intended MPU memory restrictions.\nPost-exploitation impact involves the unauthorized reading of privileged kernel memory spaces, potentially exposing sensitive system state information, cryptographic materials, or control data structures to the unprivileged task.\nThe affected versions comprise all FreeRTOS-Kernel iterations prior to version 11.3.1.\nThe vulnerability does not inherently require network exposure, as it relies on local task execution within the embedded operating system environment, targeting systems utilizing MPU configurations and queue sets."
}