Kill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes
summary
Finds universal MPU deployment mistakes in six commodity RTOSes (FreeRTOS, MbedOS, Azure ThreadX, TizenRT, rt-thread and others) that let unprivileged tasks pass unchecked SVC/CH parameters to kernel entry points, overwrite saved execution state on task stacks, and gain arbitrary read/write and privilege escalation. Demonstrates live exploitation on real devices, supplies analysis scripts (reporting 43 TR functions leading to write flaws, 29 for read, 23 other issues), shows MPU region misconfiguration and missing permission checks, and notes FreeRTOS fixes merged.
AI-written summary · about
chapters (14)
- 0:00MPU-based RTOS vulnerabilities
- 1:32MPU adoption in embedded systems
- 3:01MPU flaws in OTA updates
- 6:40Security flaws in 6 RTOSes
- 7:23FreeRTOS MPU memory protection
- 9:31TR flaws in task switching
- 12:48Privilege escalation via stack
- 13:32MPU region overlapping
- 15:43Amazon FreeRTOS mitigations
- 18:57StruX OS MPU memory
- 20:00StruX TR parameter gaps
- 21:5195 TR function flaws found
- 22:56MPU security comparison
- 24:00Future MPU hardening
related talks
32mGood Motive but Bad Design: Pitfalls in MPU Usage in Embedded Systems in the Wild
41mIs Your Memory Protected? Uncovering Vul In Automotive MPU 
21mSoK: Where’s the “up”?! A Comprehensive (bottom-up) Study on the Security of...
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
37mAttacking NPUs of Multiple Platforms
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
53mBack To The Future With Platform Security