Summary
FreeRTOS is a real-time operating system (RTOS) from AWS for microcontrollers and small microprocesses.
We identified an unintended script within specific zip files available in the Releases page of the FreeRTOS GitHub project. This issue only affects zip files downloaded directly from the Releases page – not users who obtained files through Git commands.
The script does not function due to a syntax error. However, if a user manually corrects the error, then the unintended script could be executed by building a Visual Studio project file contained in the zip file. The script could have transmitted AWS account credentials if those credentials were stored in the user's home directory on a Linux or MacOS based operating system.
Out of an abundance of caution, users who downloaded the indicated releases directly from the Releases page during the time frames referenced below, fixed the script syntax error, and built a demo referenced below, should rotate AWS credentials present in their build host computer’s home directory's .aws/credentials file.
We have removed the indicated releases to prevent further downloads. Users should also delete their copies of the indicated releases. AWS customers who need further assistance should contact AWS Support.
Impact
This issue affected the following zipped release files between the specified time frame:
- FreeRTOS release 202212.01, asset FreeRTOSv202212.01.zip between May 6, 2025 and May 8, 2025.
- SHA256:
54bd2e2e0c7a3137f4b9ff09d40c171f25ec7aa528de0c3ac8faf5c4600177e4
- FreeRTOS release 202112.00, asset FreeRTOSv202112.00.zip between May 6, 2025 and May 8, 2025.
- SHA256:
0b45b6ff147edf529dc5b6747d3893718905f5204afaa10acbbe0189f81cfe93
The following is a list of affected demos:
- WIN32-MSVC
- WIN32-MSVC-Static-Allocation-Only
- VisualStudio_StaticProjects based demos
- coreHTTP_Windows_Simulator based demos
- Jobs_Windows_Simulator based demos
- Ota_Windows_Simulator based demos
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
sweeneyirrigreen Reporter
Summary
FreeRTOS is a real-time operating system (RTOS) from AWS for microcontrollers and small microprocesses.
We identified an unintended script within specific zip files available in the Releases page of the FreeRTOS GitHub project. This issue only affects zip files downloaded directly from the Releases page – not users who obtained files through Git commands.
The script does not function due to a syntax error. However, if a user manually corrects the error, then the unintended script could be executed by building a Visual Studio project file contained in the zip file. The script could have transmitted AWS account credentials if those credentials were stored in the user's home directory on a Linux or MacOS based operating system.
Out of an abundance of caution, users who downloaded the indicated releases directly from the Releases page during the time frames referenced below, fixed the script syntax error, and built a demo referenced below, should rotate AWS credentials present in their build host computer’s home directory's .aws/credentials file.
We have removed the indicated releases to prevent further downloads. Users should also delete their copies of the indicated releases. AWS customers who need further assistance should contact AWS Support.
Impact
This issue affected the following zipped release files between the specified time frame:
54bd2e2e0c7a3137f4b9ff09d40c171f25ec7aa528de0c3ac8faf5c4600177e40b45b6ff147edf529dc5b6747d3893718905f5204afaa10acbbe0189f81cfe93The following is a list of affected demos:
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.