Executive brief
FreeRTOS-Kernel is a real-time operating system kernel used in embedded and IoT devices to manage task scheduling and system resources. A missing privilege check in the secure context cleanup handler allows local users to trigger a use-after-free vulnerability in secure memory, potentially leading to privilege escalation or system crashes that could disrupt device operations.
Technical details
The vulnerability is a use-after-free condition in the ARMv8-M secure context cleanup handler due to missing privilege verification. The SVC handler for secure context deallocation (portSVC_FREE_SECURE_CONTEXT) was not validating whether the calling code was privileged before processing the deallocation request. An attacker with local code execution can invoke the SVC handler from unprivileged code to free a secure context that is currently in use, leaving running tasks referencing freed secure memory. The fix, released in version 11.3.1, adds privilege validation to ensure the calling program counter lies within the privileged functions section when MPU is enabled, and rejects requests from unprivileged code.
Affected products
- Amazon FreeRTOS-Kernel before 11.3.1
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Version 11.3.1 released