Remove local stack variable form MPU wrappers

Browse source

It was possible for a third party that had already independently gained
the ability to execute injected code to achieve further privilege
escalation by branching directly inside a FreeRTOS MPU API wrapper
function with a manually crafted stack frame. This commit removes the
local stack variable `xRunningPrivileged` so that a manually crafted
stack frame cannot be used for privilege escalation by branching
directly inside a FreeRTOS MPU API wrapper.

We thank Certibit Consulting, LLC, Huazhong University of Science and
Technology and the SecLab team at Northeastern University for reporting
this issue.

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>

...

This commit is contained in:

Gaurav Aggarwal 2022-09-07 14:57:37 +05:30 • committed by Gaurav-Aggarwal-AWS

parent c2d616eaee

commit 79704b8213

7 changed files with 1693 additions and 490 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1907

portable/Common/mpu_wrappers.c

View file

File diff suppressed because it is too large Load diff