Arbitrary Code Execution in BOOM RTL Benchmark

Executive Summary

This vulnerability is a privilege-state restoration flaw in the Berkeley Out-of-Order Machine (BOOM) RTL benchmark. It involves incorrect handling of the mstatus.MPRV flag during MRET instructions, where the flag remains set after returning to a less-privileged mode. This causes memory-access operations to use stale privilege state, potentially leading to privilege escalation or incorrect access control.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the BOOM processor RTL implementation and requires RTL simulation or hardware verification tools. Use ProcessorFuzz with BOOM RTL to detect it via fuzzing and trace analysis. Run scripts like start_fuzzing_boom.sh with FP_CSR or ALL_CSR modes enabled to identify discrepancies in CSR state restoration after MRET instructions.

Useful 0 Not Useful 0

Impact Analysis

The impact depends on the system using BOOM. If exploited, it could allow a privileged attacker to bypass memory-access restrictions, leading to unauthorized data access or code execution. However, exploitation requires a privileged execution path, such as a local attacker or OS component capable of modifying Machine-mode CSR state.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves incorrect privilege-state restoration in the BOOM processor, specifically improper handling of the mstatus.MPRV flag during MRET instructions. While this could theoretically lead to privilege escalation or unauthorized memory access, the provided context does not detail direct impacts on GDPR or HIPAA compliance. Compliance implications would depend on system-specific deployment and data handling scenarios.

Useful 0 Not Useful 0

Mitigation Strategies

No official patch is available yet. Users should monitor the BOOM repository and ProcessorFuzz for updates. Avoid relying on MPRV for privilege checks in custom code. Validate RTL implementations against RISC-V Privileged Architecture specifications for correct MRET and mstatus.MPRV handling.

Useful 0 Not Useful 0