CVE-2024-28115 Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled

What is CVE-2024-28115?

CVE-2024-28115 is a high-severity vulnerability in FreeRTOS-Kernel, published on 7 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.

Weakness: CWE-284

Which versions are affected by CVE-2024-28115?

It affects 1 product.

Products include Amazon Freertos.

How do I fix CVE-2024-28115?

No fix has been published for CVE-2024-28115 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-28115 being exploited?

There is no known exploitation of CVE-2024-28115 in the wild and no public exploit code.

Other vulnerabilities in FreeRTOS-Kernel

• CVE-2021-32020 Memory corruption in n/a Critical 9.8
• CVE-2021-31571 Integer overflow in n/a Critical 9.8
• CVE-2021-31572 Integer overflow in n/a Critical 9.8
• CVE-2026-77234 Improper input validation in FreeRTOS-Kernel timer command handling Critical 9.3
• CVE-2026-77235 Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xcv7-v92w-gq6r.