Login Sign Up

CVE-2021-43997

7.8 HIGH

📋 TL;DR

This CVE allows privilege escalation in FreeRTOS on ARMv7-M and ARMv8-M systems with MPU enabled. Non-kernel code can call privileged functions, and attackers with code execution can craft stack frames to escalate privileges further. Affects FreeRTOS versions 10.2.0 through 10.4.5/10.4.6 depending on the specific issue.

💻 Affected Systems

Products:
  • FreeRTOS
Versions: 10.2.0 through 10.4.5 for first issue, through 10.4.6 for second issue
Operating Systems: Embedded systems using FreeRTOS on ARMv7-M or ARMv8-M architectures
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled (configENABLE_MPU set to 1)

📦 What is this software?

Freertos by Amazon

View all CVEs affecting Freertos →

Freertos by Amazon

View all CVEs affecting Freertos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise where an attacker gains kernel-level privileges, bypassing memory protection mechanisms to execute arbitrary code with highest privileges.

🟠

Likely Case

Privilege escalation from user mode to kernel mode, allowing attackers to bypass security boundaries and access protected memory regions.

🟢

If Mitigated

Limited impact if proper memory protection and privilege separation are already implemented at hardware/software layers.

🌐 Internet-Facing: MEDIUM - Exploitation requires initial code execution capability, but many IoT/embedded devices with FreeRTOS are internet-facing.
🏢 Internal Only: MEDIUM - Similar risk profile but depends on network segmentation and initial access vectors.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires initial code execution capability and knowledge of FreeRTOS internals to craft proper stack frames.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V10.5.0 or V10.4.3-LTS Patch 3

Vendor Advisory: https://github.com/FreeRTOS/FreeRTOS-Kernel/releases

Restart Required: Yes

Instructions:

1. Download patched version from FreeRTOS GitHub releases. 2. Replace vulnerable FreeRTOS kernel files. 3. Recompile and redeploy firmware. 4. Restart affected devices.

🔧 Temporary Workarounds

Disable MPU support

all

Set configENABLE_MPU to 0 to disable Memory Protection Unit features

# In FreeRTOSConfig.h: #define configENABLE_MPU 0

Memory protection hardening

all

Implement additional memory protection layers and privilege separation

🧯 If You Can't Patch

  • Implement strict network segmentation to isolate vulnerable devices
  • Deploy runtime protection mechanisms and monitor for privilege escalation attempts

🔍 How to Verify

Check if Vulnerable:

Check FreeRTOS version in source code and verify configENABLE_MPU setting

Check Version:

# Check FreeRTOS version in source: grep -r "tskKERNEL_VERSION_NUMBER" or examine FreeRTOS.h

Verify Fix Applied:

Verify FreeRTOS version is 10.5.0+ or 10.4.3-LTS Patch 3+ and test privilege escalation attempts

📡 Detection & Monitoring

Log Indicators:

  • Unexpected privilege escalation attempts
  • Memory access violations in protected regions
  • Abnormal kernel function calls

Network Indicators:

  • Unusual device behavior or communication patterns

SIEM Query:

Device logs showing privilege changes or memory protection violations

📊 Metadata

CVE ID: CVE-2021-43997
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: November 17, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON