]> begriffs open source - freertos/commit
Remove local stack variable form MPU wrappers
authorGaurav Aggarwal <aggarg@amazon.com>
Wed, 7 Sep 2022 09:27:37 +0000 (14:57 +0530)
committerGaurav-Aggarwal-AWS <33462878+aggarg@users.noreply.github.com>
Fri, 16 Sep 2022 18:33:08 +0000 (00:03 +0530)
commit79704b8213320c32db928a75a262cfa92b2650e0
treee28dcb2c683b62a463714c891187cb0cbe96a1e3
parentc2d616eaee4e562399403e5816246b657739a98e
Remove local stack variable form MPU wrappers

It was possible for a third party that had already independently gained
the ability to execute injected code to achieve further privilege
escalation by branching directly inside a FreeRTOS MPU API wrapper
function with a manually crafted stack frame. This commit removes the
local stack variable `xRunningPrivileged` so that a manually crafted
stack frame cannot be used for privilege escalation by branching
directly inside a FreeRTOS MPU API wrapper.

We thank Certibit Consulting, LLC, Huazhong University of Science and
Technology and the SecLab team at Northeastern University for reporting
this issue.

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>
.github/lexicon.txt
include/mpu_wrappers.h
portable/Common/mpu_wrappers.c
portable/GCC/ARM_CM3_MPU/port.c
portable/GCC/ARM_CM4_MPU/port.c
portable/IAR/ARM_CM4F_MPU/port.c
portable/RVDS/ARM_CM4_MPU/port.c