Incorrect Privilege Assignment in Berkeley Out-of-Order Machine

Executive Summary

This vulnerability involves incorrect privilege assignment in the Berkeley Out-of-Order Machine (BOOM) versions 3 and 4. The issue occurs in the NBDTLB implementations where the raw mstatus.SUM value is used in read and write permission logic without checking satp.MODE at the use site. This can lead to privilege escalation or information disclosure if specific conditions are met.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your BOOM core version is 3 or 4 and if it uses the affected NBDTLB implementations in src/main/scala/v3/lsu/tlb.scala or src/main/scala/v4/lsu/tlb.scala. Verify the commit hash matches 5223e44cfeb26f41380057a2eb4d651197475f69.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability may allow a local attacker to trigger privileged software, firmware, exception-return, or state-transition paths that set mstatus.SUM=1 while satp.MODE=0. This could result in improper memory-access permissions, potentially leading to privilege escalation or unauthorized data access.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from the BOOM repository or update to a version that includes the fix for the NBDTLB privilege assignment issue. Review memory access permissions and privilege checks in the TLB implementations.

Useful 0 Not Useful 0