Security
The EU Cyber Resilience Act lists operating systems among its important products, and KideRT is one. Preempt Systems is preparing KideRT for the Act, with free security fixes, an SBOM in every release and one address for vulnerability reports.
- CRA categoryClass Iimportant product
- Security fixesFreefor five years after the first release of each minor version
- Software bill of materialsIncludedin every release
- Vulnerability reportsOne addresssecurity@preemptsystems.com
Reporting a vulnerability
Send reports about KideRT to security@preemptsystems.com. Reports are handled under coordinated disclosure, so keep the details private until the fix and its advisory are out.
See the security advisoriesThe report
The KideRT release, the processor and board, the steps or code that show the problem, and whether it is known to be exploited.
The acknowledgement
KideRT’s developers confirm receipt within five working days, then reproduce the problem and keep the reporter informed.
The fix and advisory
A fix or mitigation within 90 days of the report. It ships to licensees together with a public advisory.
Security updates
Security fixes are free for five years after the first release of each KideRT minor version. Feature updates and support follow the licence term, one year at a time.
See what a licence covers- Security fixes
- Free of charge for five years after the first release of each KideRT minor version.
- Advisories
- Published on the advisories page when the fix ships, naming the affected releases, the fixed release and any mitigation.
- Feature updates
- New releases during the licence term.
- Support
- Direct access to KideRT’s developers by email or calls during the licence term.
Release signatures
KideRT releases are signed by Preempt Systems Oy, and each comes with a .minisig signature file. Verify a release with minisign 0.10 or later before using it. If verification fails, do not use the release, and report it to security@preemptsystems.com.
Download the public keyminisign -Vm KideRT-v1.3.0.tar.gz -P RWSTs1/O/p3Z88/8e9uuxQchOB2e9gCx62Jy0rrU5mprJ5FhcKEn4nmsProducts built on KideRT
A manufacturer that builds KideRT into a product assesses the product as a whole, and checks that its components do not weaken it. Each KideRT release brings what that assessment needs from the RTOS.
Software bill of materials
A machine-readable SBOM in every release lists KideRT’s components for the product’s own SBOM.
Full source
The licence includes the latest source, for review and testing in the product’s risk assessment.
Vulnerabilities found in KideRT
The Act asks manufacturers to report a vulnerability they find in a component to its maker. For KideRT, that is security@preemptsystems.com.
Memory protection and the Act
The Act asks a product to limit its attack surface, protect the integrity of its programs and data, and reduce the impact of an incident with exploit mitigations. On a processor with an MPU, KideRT’s memory protection limits each thread to the memory and peripherals granted to it, which serves all three.
See memory protection- Attack surface
- A thread reaches the kernel only through POSIX calls, and peripherals only through regions granted to it.
- Integrity
- A thread cannot read or write kernel memory or other threads’ stacks.
- Exploit mitigation
- A read or write outside the thread’s regions raises a fault instead of reaching the rest of the system.
Questions about KideRT and the Act
Does building on KideRT make a product an important product?
Not by itself. The Commission’s descriptions of the categories classify a product by its core functionality, so a device is not an operating system because it runs one.
Who reports an actively exploited vulnerability?
Each manufacturer reports for its own product. Preempt Systems reports for KideRT, and the manufacturer of a device reports for the device.
Does KideRT carry the CE marking?
Not yet. The Act’s product requirements and the CE marking apply from 11 December 2027, and Preempt Systems is preparing KideRT for its assessment as a Class I product.
KideRT and the Cyber Resilience Act
Discuss the security requirements of your product with KideRT’s developers.