Executive brief
FreeRTOS-Kernel is a real-time operating system kernel used in embedded systems and IoT devices. A type confusion vulnerability in the xQueueAddToSet() function allows an unprivileged task running on systems with Memory Protection Unit (MPU) enabled to read privileged kernel memory by passing an ordinary queue instead of a queue set, potentially exposing sensitive system data.
Technical details
The vulnerability is a type confusion flaw in xQueueAddToSet() that fails to validate whether the object passed as a queue set is actually a queue set (identified by an item size of sizeof(Queue_t *)). An attacker-controlled unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 can pass an ordinary queue, causing prvNotifyQueueSetContainer to copy item-size bytes from a single pointer on the stack, leading to unauthorized kernel memory disclosure. The attack requires local task execution privileges and specific kernel configuration but does not require administrative access. The vulnerability was fixed in FreeRTOS-Kernel version 11.3.1 by adding type validation that now returns pdFAIL when a non-queue-set object is passed.
Affected products
- FreeRTOS FreeRTOS-Kernel before 11.3.1
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Fixed in FreeRTOS-Kernel v11.3.1