OpenXiangShan NEMU CVE-2026-29647

Exploitation requires three specific conditions: (1) authenticated local access to the host system running NEMU with ability to invoke the emulator and supply guest code, (2) guest code execution capability at S-mode or U-mode within the emulated RISC-V environment, and (3) mstateen0.IMSIC intentionally cleared by the emulator/privileged software (indicating a security policy to deny IMSIC access to lower-privileged contexts). Exploitation does NOT work in default configurations where mstateen0.IMSIC is enabled or against kernels that do not use Smstateen permission controls. The vulnerability is conditional on NEMU being compiled without the CSR permission fix and the guest environment attempting to enforce Smstateen-based access policies. Systems using NEMU purely for instruction emulation without relying on Smstateen correctness are less impacted.

Risk is LOW-TO-MODERATE in practice despite the 6.5 CVSS score. The EPSS score of 0.02% (4th percentile) strongly suggests minimal real-world exploitation likelihood. The vulnerability requires authenticated local access (PR:L in CVSS vector) and affects a specialized RISC-V emulator used primarily in research, academic, and development environments rather than production systems. The CVSS AV:N (network) designation appears inconsistent with the authenticated local access (PR:L) requirement - network-exposed NEMU instances are uncommon. The actual attack surface is significantly narrower than the CVSS score suggests: exploitation requires an attacker with local user privileges on a system running NEMU, combined with guest code execution within the emulated environment. No KEV listing or public POC identified. The information disclosure impact (C:H) is relevant only to systems where interrupt state confidentiality matters; in typical NEMU deployments (development/testing), this is low-impact. Primary risk is to RISC-V architecture validation workflows where Smstateen compliance is being tested.

An attacker with local user access to a host system running OpenXiangShan NEMU spawns guest code within the emulated RISC-V environment. The guest code executes in S-mode or U-mode and attempts to read the stopei CSR to observe interrupt state, even though the host-emulator has cleared mstateen0.IMSIC to deny such access. Due to insufficient permission checks, the guest code successfully reads IMSIC state including pending interrupt signals intended to be private to the hypervisor or higher privilege levels, leaking sensitive interrupt timing or endpoint information.