CVE-2024-28115

Katalog CVE

CVSS 7.8 · High EPSS 0,24%

Kerentanan Improper Access Control pada amazon freertos. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.

Rincian

Terbit di NVD

7 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-xcv7-v92w-gq6r deskripsi teknis · advisory vendor
• https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.6.2 release notes