Nvidia

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK API TOKEN or BD HUB TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

**Name of the Vulnerable Software and Affected Versions** FreeRTOS-Kernel versions prior to 11.3.1 **Description** Improper input validation may allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. MPU (Memory Protection Unit) is a hardware component that monitors memory access to prevent tasks from accessing unauthorized memory regions. **Recommendations** Upgrade to version 11.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRTOS-Kernel versions prior to 11.3.1 **Description** A missing privilege verification in the secure context cleanup handler allows local users to trigger a use-after-free condition in secure-world memory. This occurs through the SVC handler used for secure context deallocation. A use-after-free is a scenario where a program continues to use a pointer after it has been freed, which can lead to crashes or unauthorized memory access. **Recommendations** Upgrade to version 11.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRTOS-Kernel versions prior to 11.3.1 **Description** Missing minimum size validation in secure context allocation allows local users to corrupt secure-world heap metadata. This occurs via an out-of-bounds write when an undersized stack size parameter is used within the `SecureContext AllocateContext()` function. **Recommendations** Upgrade to version 11.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRTOS-Kernel versions prior to 11.3.1 **Description** Missing queue-set type validation in the `xQueueAddToSet()` function may allow an unprivileged task to read privileged kernel memory. This issue occurs on MPU-enabled ports when `configUSE QUEUE SETS` is set to 1. MPU (Memory Protection Unit) is a hardware component that monitors memory access to prevent unauthorized access to specific memory regions. **Recommendations** Upgrade to version 11.3.1 or later.