PT-2023-12363 · Or1200 · Or1200

Published 2023-04-18 · Updated 2023-04-27 · CVE-2021-40506

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OR1200 (aka OpenRISC 1200) processor versions 2011-09-10 through 2015-11-11

Description An issue in the ALU unit of the processor causes the overflow flag not to be updated for the msb and mac instructions, resulting in an incorrect value in the overflow flag. This can lead to corruption in execution for any software that relies on this flag.

Recommendations For versions 2011-09-10 through 2015-11-11, consider modifying software to not rely on the overflow flag for the msb and mac instructions until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-40506

Affected Products

Or1200

References · 4

• https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5 · Patch
• https://osv.dev/vulnerability/CVE-2021-40506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40506 · Security Note
• https://seth.engr.tamu.edu/software-releases/thehuzz · Note