Executive Summary

This vulnerability exists in the XiangShan open-source high-performance RISC-V processor, specifically in its CSR (Control and Status Register) subsystem called NewCSR. Certain sequences of CSR operations that target non-existent or custom CSR addresses may cause an illegal-instruction exception. However, the processor fails to reliably transfer control to the configured trap handler (mtvec) when this happens. This improper handling can disrupt the control flow and potentially leave the processor core in a hung or unrecoverable state.

An attacker who can execute code locally on the processor can exploit this flaw to cause a denial of service or potentially create an inconsistent architectural state.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited by a local attacker to cause a denial of service on the affected processor. This means the processor core could become hung or enter an unrecoverable state, disrupting normal operation.

Additionally, it may lead to an inconsistent architectural state, which could affect the reliability and correctness of the processor's operations.

Useful 0 Not Useful 0