]> begriffs open source - freertos/commit
Remove local stack variable form MPU wrappers
authorGaurav Aggarwal <aggarg@amazon.com>
Wed, 7 Sep 2022 14:19:48 +0000 (19:49 +0530)
committerGaurav-Aggarwal-AWS <33462878+aggarg@users.noreply.github.com>
Fri, 16 Sep 2022 16:48:35 +0000 (22:18 +0530)
commit51ea2bfe62f862b4f016b38e4c11abdc60fd4088
tree401366a257da2a7e2329591fba07118998d8b804
parentc4ad77f694e9737f512d4ff4c527e46d31c2732c
Remove local stack variable form MPU wrappers

It was possible for a third party that had already independently gained
the ability to execute injected code to achieve further privilege
escalation by branching directly inside a FreeRTOS MPU API wrapper
function with a manually crafted stack frame. This commit removes the
local stack variable `xRunningPrivileged` so that a manually crafted
stack frame cannot be used for privilege escalation by branching
directly inside a FreeRTOS MPU API wrapper.

We thank Certibit Consulting, LLC, Huazhong University of Science and
Technology and the SecLab team at Northeastern University for reporting
this issue.

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>
.github/lexicon.txt
include/mpu_wrappers.h
portable/Common/mpu_wrappers.c
portable/GCC/ARM_CM3_MPU/port.c
portable/GCC/ARM_CM4_MPU/port.c
portable/IAR/ARM_CM4F_MPU/port.c
portable/RVDS/ARM_CM4_MPU/port.c