79704b8213
It was possible for a third party that had already independently gained the ability to execute injected code to achieve further privilege escalation by branching directly inside a FreeRTOS MPU API wrapper function with a manually crafted stack frame. This commit removes the local stack variable `xRunningPrivileged` so that a manually crafted stack frame cannot be used for privilege escalation by branching directly inside a FreeRTOS MPU API wrapper. We thank Certibit Consulting, LLC, Huazhong University of Science and Technology and the SecLab team at Northeastern University for reporting this issue. Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com> |
||
|---|---|---|
| .. | ||
| ARMClang | ||
| ARMv8M | ||
| BCC/16BitDOS | ||
| CCS | ||
| CodeWarrior | ||
| Common | ||
| GCC | ||
| IAR | ||
| Keil | ||
| MemMang | ||
| MikroC/ARM_CM4F | ||
| MPLAB | ||
| MSVC-MingW | ||
| oWatcom/16BitDOS | ||
| Paradigm/Tern_EE | ||
| Renesas | ||
| Rowley | ||
| RVDS | ||
| SDCC/Cygnal | ||
| Softune | ||
| Tasking/ARM_CM4F | ||
| ThirdParty | ||
| WizC/PIC18 | ||
| CMakeLists.txt | ||
| readme.txt | ||
Each real time kernel port consists of three files that contain the core kernel components and are common to every port, and one or more files that are specific to a particular microcontroller and/or compiler. + The FreeRTOS/Source/Portable/MemMang directory contains the five sample memory allocators as described on the https://www.FreeRTOS.org WEB site. + The other directories each contain files specific to a particular microcontroller or compiler, where the directory name denotes the compiler specific files the directory contains. For example, if you are interested in the [compiler] port for the [architecture] microcontroller, then the port specific files are contained in FreeRTOS/Source/Portable/[compiler]/[architecture] directory. If this is the only port you are interested in then all the other directories can be ignored.