PT-2025-33737 · Riscv Boom · Sonicboom

Published 2025-08-19 · Updated 2025-08-19 · CVE-2025-50897

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: riscv-boom SonicBOOM 1.2

Description: A flaw exists in the processor implementation where valid virtual-to-physical address translations with write permissions in SV39 mode may incorrectly trigger a Store/AMO access fault during store instructions, despite valid page table entries and memory access modes. This can occur when transitioning into virtual memory and attempting store operations in mapped kernel memory, potentially causing kernel panics or denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Access Control

Protection Mechanism Failure

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-693

CWE-434

Related Identifiers

CVE-2025-50897

Affected Products

Sonicboom

References · 8

• 🔥 https://github.com/LuLuji04/POC-Boomv1.2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-50897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50897 · Security Note
• https://github.com/riscv-software-src/riscv-isa-sim · Note
• https://github.com/riscv-boom/riscv-boom · Note
• https://twitter.com/VulmonFeeds/status/1957843898862075927 · Twitter Post
• https://twitter.com/CVEnew/status/1957818279386296483 · Twitter Post
• https://t.me/CVEtracker/30361 · Telegram Post