13 vulnerabilities were discovered in the popular open-source operating system FreeRTOS in which 4 are remote code execution vulnerabilities
13 vulnerabilities were discovered in the popular open-source operating system FreeRTOS in which 4 are remote code execution vulnerabilities. FreeRTOS is an open-source operating system used in small microprocessors and microcontrollers used in smart home and other critical infrastructure products. The vulnerabilities were discovered by security researchers Ori Karliner at Zimperium zlabs. “During our research, we discovered multiple vulnerabilities within FreeRTOS’s TCP/IP stack and in the AWS secure connectivity modules. The same vulnerabilities are present in WHIS Connect TCP/IP component for OpenRTOSSafeRTOS.” The vulnerabilities were found in the FreeRTOS’s TCP/IP stack and in the AWS secure connectivity modules. the same vulnerabilities were also discovered in WHIS Connect TCP/IP component for OpenRTOSSafeRTOS. Attackers can exploit these vulnerabilities to crash the device, extract information from the device memory and for remote code execution. By this way, attackers can completely compromise the device. The flaw affects FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), AWS FreeRTOS up to V1.3.1, WHIS OpenRTOS and SafeRTOS (With WHIS Connect middleware TCP/IP components). The company notified the flaw to Amazon and cooperated with them to fix the issues. The patches were released for AWS FreeRTOS versions 1.3.2 and others. WHIS has also confirmed about the vulnerabilities and patches were also released. Here below is the list of vulnerabilities discovered by the company. CVE-2018-16522(Remote code execution), CVE-2018-16525 (Remote code execution), CVE-2018-16526 (Remote code execution), CVE-2018-16528(Denial of service), CVE-2018-16523(Information leak), CVE-2018-16524(Information leak), CVE-2018-16527(Information leak), CVE-2018-16599(Information leak), CVE-2018-16600(Information leak), CVE-2018-16601(Information leak), CVE-2018-16602(Information leak), CVE-2018-16603(Information leak), CVE-2018-16598(Other). "FreeRTOS and SafeRTOS have been used in a wide variety of industries: IoT, Aerospace, Medical, Automotive, and more. Due to the high risk nature of devices in some of these industries, zLabs decided to take a look at the connectivity components that are paired with these OS’s. Clearly, devices that have connectivity to the outside world are at a higher degree of risk of being attacked." said in the post published by the company. For the latest cyber threats and the latest hacking news please follow us on Facebook, Linkedin and Twitter.
You may be interested in reading:Critical Flaw in Branch.io Affects Around 685 Million Users