Description

An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service (DoS).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T21:16:37.430Z",
  "pubdate": "2026-08-26T21:16:37.430Z",
  "executiveSummary": "This vulnerability concerns an architectural flaw within the openRISC OR1200 processor core, specifically identified in commit 83ac6b. The issue manifests as an inaccurate update of the program counter (PC) register during Special Purpose Register (SPR) modifications.\nThe vulnerability is classified as a logic error impacting architectural state consistency. Successful exploitation results in a Denial of Service (DoS) condition, as the core enters an invalid execution state or stalls due to corrupted instruction sequencing.\nThe flaw affects the OR1200 processor core at the specified commit level. The risk implications are severe for embedded systems relying on this processor, as unauthorized state manipulation can effectively brick the execution pipeline or force a kernel panic/system hang.\nThe attacker requires the ability to execute instructions that trigger SPR writes, such as privileged software or malicious code capable of manipulating processor control registers. No network exposure is inherent to the hardware flaw itself, but the impact is realized through local instruction execution that forces the PC into an undefined or illegal memory address space, leading to a complete cessation of service.",
  "technicalDetails": "The root cause of this vulnerability lies in the OR1200 pipeline's handling of the Special Purpose Register (SPR) write-back stage and its synchronization with the instruction fetch unit. Specifically, when an instruction modifies an SPR that influences the control flow or architectural state, the logic responsible for updating the program counter (PC) fails to account for the pipeline depth or the atomic nature of the register update cycle.\nDuring the execution of instructions that update SPRs—particularly those governing status registers or configuration bits that might trigger a flush or a jump—the PC logic inconsistently applies the new state. This results in the PC register being loaded with an incorrect address, often pointing to an unmapped memory region, a forbidden instruction boundary, or a misalignment point within the instruction cache.\nThe exploitation flow begins when an attacker gains the privilege to write to specific SPRs. By crafting a sequence of instructions that force an SPR update in a specific pipeline alignment, the attacker can cause the hardware to miscalculate the target address for the next fetch cycle. When the processor attempts to fetch the next instruction from the corrupted PC value, it triggers a bus error, a privilege violation, or an illegal instruction trap. If the OR1200 exception handler is not robustly implemented to recover from such architectural inconsistencies, the entire processor core halts, leading to a permanent DoS.\nThe vulnerable component is the execution unit's SPR access controller and its feedback loop to the Instruction Fetch Unit (IFU). Because the OR1200 uses a multi-stage pipeline, the delay between the SPR update detection and the actual PC stall or branch resolution is critical. The flaw is present in commit 83ac6b, where the logic fails to stall the pipeline correctly until the PC update is safely committed, leading to an 'inaccurate update' scenario. The lack of state interlock ensures that subsequent fetches proceed with a stale or malformed PC value before the architectural state is fully synchronized.\nPost-exploitation, the processor remains in a locked state. The impact is a system-wide hang that usually necessitates a hardware reset to restore operations. Since this is an architectural issue, it cannot be mitigated by software patching at the kernel level; it requires a modification to the RTL or a microcode-level fix if the architecture supports it."
}