VULNERABILITY INTELLIGENCE

CVE-2024-28115

CVSS score8.8 HIGH
EPSS probability0.24%
CISA KEVNot currently listed
Published2024-03-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.

Weakness classification

  • security-advisories@github.com: CWE-284
  • nvd@nist.gov: NVD-CWE-Other

Primary references