EUVD-2026-61144
GHSA-5x2c-mgv4-rwhh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local execution with low privileges is sufficient to manipulate mstatus/satp; no scope change as impact is contained within the BOOM system.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site
AnalysisAI
Incorrect privilege assignment in the Berkeley Out-of-Order Machine (BOOM) RISC-V processor implementation - specifically the v3 and v4 Non-Blocking Data TLB (NBDTLB) - allows a local, low-privileged attacker to bypass memory access controls. The flaw arises because the raw mstatus.SUM bit participates in read/write permission decisions without a corresponding validity check on satp.MODE at the use site, meaning the SUM-based access relaxation may apply even when paging is inactive (Bare mode). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on a system running the BOOM processor implementation (physical FPGA or RTL simulation environment) at a minimum of low privilege (PR:L per CVSS), sufficient to write to mstatus and satp control registers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.8 and is internally consistent with the described flaw: exploitation requires local code execution at user or supervisor privilege, no interactive target is needed, and the potential impact on confidentiality, integrity, and availability is high if an attacker can craft the right mstatus/satp state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update to the riscv-boom/riscv-boom repository at or beyond commit 5223e44cfeb26f41380057a2eb4d651197475f69 (https://github.com/riscv-boom/riscv-boom/commit/5223e44cfeb26f41380057a2eb4d651197475f69). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running Berkeley BOOM v3 or v4 processors and document current user access controls, privilege separation policies, and workload isolation mechanisms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today