Skip to main content

FreeRTOS Remote Code Execution Vulnerabilities

Security researchers have disclosed details of thirteen critical vulnerabilities in the FreeRTOS kernel. They claim that a remote attacker could exploit some or all these vulnerabilities to cause a denial-of-service condition, collect information from system memory or execute arbitrary code on affected systems.

Threat ID:
CC-2743
Category:
Exploit
Threat Severity:
Medium
Threat Vector:
Published:
24 October 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Security researchers have disclosed details of thirteen critical vulnerabilities in the FreeRTOS kernel. They claim that a remote attacker could exploit some or all these vulnerabilities to cause a denial-of-service condition, collect information from system memory or execute arbitrary code on affected systems.

Threat details

FreeRTOS is a popular open-source real-time operating system used in embedded systems, including internet of things and medical devices. Since 2017, it has been maintained by Amazon (sometimes referred to as a:FreeTROS), after they added a wide range of new modules and capabilities.

All thirteen vulnerabilities are related to FreeRTOS' TCP/IP software stack and the Amazon Web Services secure connectivity module. At the time of publication, the researchers have not released any further details to allow vendors to produce patches.

For further information:

Remediation advice

Amazon have addressed these vulnerabilities in FreeRTOS 1.3.2. Organisations should apply this update to their affected systems immediately.

Remediation steps

Type Step

Other FreeRTOS-based operating system vendors will need to update their respective products to take advantage of the updated kernel.

Last edited: 11 January 2022 4:01 pm