PT-2025-39994 · Unknown · Rocket-Chip

Heyfenny · Published 2025-09-30 · Updated 2025-12-23 · CVE-2025-56301

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29)

Description An issue exists in the Control and Status Register (CSR) logic that allows attackers to corrupt exception handling and privilege state transitions. This occurs due to a flawed interaction between exception handling and Machine Return (MRET) mechanisms when an exception is triggered during MRET execution. Specifically, when the MRET instruction is executed in machine mode without being in an exception state, an Instruction Access Fault may be triggered. This simultaneous activation of both exception handling and exception return logic leads to conflicting updates to the control and status registers, resulting in faulty trap behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1281

Related Identifiers

CVE-2025-56301

Affected Products

Rocket-Chip

References · 11

• 🔥 https://github.com/heyfenny/Vulnerability_disclosure/blob/main/RISCV/Rocket-chip/CVE-2025-56301/details.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56301 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56301 · Vendor Advisory
• https://github.com/chipsalliance/rocket-chip · Note
• https://github.com/chipsalliance/rocket-chip/blob/f517abbf41abb65cea37421d3559f9739efd00a9/src/main/scala/rocket/CSR.scala · Note
• https://github.com/chipsalliance/rocket-chip/blob/master/src/main/scala/rocket/CSR.scala · Note
• https://twitter.com/CVEnew/status/2003567320296243705 · Twitter Post
• https://t.me/CVEtracker/33735 · Telegram Post
• https://t.me/cveNotify/139267 · Telegram Post
• https://lf-riscv.atlassian.net/wiki/spaces/HOME/pages/16154769/RISC-V+Technical+Specifications#ISA-Specifications · Note
• https://twitter.com/cracbot/status/1974791736703525127 · Twitter Post