CVE-2024-28115: Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled
FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. configENABLEMPU set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28115?
CVE-2024-28115 is categorized as a high-severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2024-28115?
To mitigate CVE-2024-28115, update FreeRTOS Kernel to version 10.6.2 or later.
What versions of FreeRTOS are affected by CVE-2024-28115?
CVE-2024-28115 affects FreeRTOS Kernel versions up to and including 10.6.1.
What is the exploit method for CVE-2024-28115?
CVE-2024-28115 can be exploited through Return Oriented Programming techniques if there is a code injection vulnerability.
Is remote exploitation possible with CVE-2024-28115?
CVE-2024-28115 requires local access to exploit, making remote exploitation unlikely.