PT-2021-13494 · Unknown · Risc-V Instruction Set Manual

Published 2021-08-13 · Updated 2021-08-23 · CVE-2021-1104

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RISC-V Instruction Set Manual (affected versions not specified)

Description The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register. This ambiguity may lead to a vulnerability due to the initial state of the register not being defined, potentially leading to information disclosure, data tampering, and denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-1104

Affected Products

Risc-V Instruction Set Manual

References · 3

• 🔥 https://riscv.org/news/2021/08/video-glitching-risc-v-chips-mtvec-corruption-for-hardening-isa-adam-zabrocki-and-alex-matrosov-def-con-29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-1104 · Security Note
• https://t.me/cvenotify/19943 · Telegram Post