XiangShan RISC-V Processor EUVD-2026-24131

Code execution on the XiangShan processor core at privilege level L or higher (specific privilege level depends on system integration and PMA configuration). The attacker must be able to issue CSR write instructions; this is available to any code executing in the affected privilege context (user-mode, supervisor-mode, or machine-mode depending on design). The vulnerability is unconditional once code execution is achieved - no special processor configuration, firmware version, or optional feature setting is required to trigger the improper CSR gating. The attack is limited to local execution on the core; remote exploitation is not possible. Additionally, the practical impact depends on whether PMA is actually used for security-critical memory isolation in the deployed system; systems that do not rely on PMA for access control may not experience exploitable consequences from CSR tampering.

The CVSS 5.3 score reflects local attack vector (AV:L), low complexity (AC:L), and low privilege requirement (PR:L), indicating local attackers with some privilege level can exploit this. The confidentiality, integrity, and availability impacts are all listed as low (C:L/I:L/A:L), suggesting bounded damage per exploit. However, the real-world risk depends critically on platform integration: if PMA is used to enforce critical security boundaries (memory isolation between security domains, kernel-userspace separation), even low-impact CSR tampering can cascade to high-severity privilege escalation or information disclosure. The vulnerability is a design flaw in hardware, not software; exploitation requires code execution on the processor core itself, limiting attack surface compared to network-reachable vulnerabilities. No KEV listing, POC, or EPSS score is available to assess exploitation probability. The privilege requirement (PR:L) suggests the attacker must already have some execution context on the core; the specific privilege level and how it maps to practical attack scenarios depends on system integration (hypervisor, kernel, container runtime). Given that this is a processor design flaw affecting open-source hardware used in research and some embedded systems, the practical impact is likely contained to those deployments, but the severity for any system using PMA for security isolation could be significant.

An attacker with local code execution at privilege level L (e.g., user-mode process or low-privilege kernel task, depending on integration) crafts CSR write instructions targeting non-existent or restricted PMA configuration registers. Instead of raising an illegal-instruction exception as required by RISC-V, the processor writes to the replicated PMA state, altering memory attribute enforcement. The attacker then reads or executes from memory regions that should be protected by the modified PMA settings, escalating privilege or accessing sensitive data.