EUVD-2025-210799
GHSA-f96g-rjqw-vv44
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Triggering the SPR-to-PC flaw requires privileged code execution on the OR1200 core; AV:L and PR:H better reflect this than the NVD-assigned AV:N/PR:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service (DoS).
AnalysisAI
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Technical ContextAI
OR1200 is an open-source, synthesizable 32-bit RISC soft-core processor implementing the OpenRISC 1000 architecture, commonly instantiated in FPGAs and SoCs for academic and embedded research purposes. Special Purpose Registers (SPRs) in the OpenRISC architecture control supervisor-mode behavior, including exception handling and pipeline control. CWE-691 (Insufficient Control Flow Management) identifies the root cause: the RTL logic that synchronizes the Program Counter with SPR state transitions contains an inaccuracy, allowing the PC to diverge from expected values during or after SPR writes. The specific commit implicated is 83ac6b of the openRISC OR1200 repository. The CPE provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a placeholder and offers no additional product scoping. The referenced GMU SynFuzz page indicates discovery via automated RTL-level fuzzing, a technique targeting hardware description language implementations rather than compiled software.
RemediationAI
No vendor-released patch or fixed commit is identified in the available data. Affected parties should consult the openRISC OR1200 upstream repository for a corrective RTL patch addressing the SPR-to-PC synchronization logic. As a compensating control, FPGA and SoC integrators can restrict write access to SPRs at the system integration level by limiting supervisor-mode code paths that modify SPRs to vetted, trusted firmware only, reducing the exposure surface without removing SPR functionality. Restricting untrusted code execution on OR1200 instances - for example, by enforcing memory protection and supervisor/user mode separation - would prevent an unprivileged actor from issuing the SPR writes that trigger the fault. The trade-off is reduced runtime flexibility for embedded applications that rely on dynamic SPR configuration. Monitor the upstream openRISC OR1200 repository for a patched commit and re-synthesize any deployed bitstreams after applying the fix.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-691 – Insufficient Control Flow Management
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today