Executive brief
The openRISC OR1200 processor, a popular open-source CPU core used in embedded systems and custom hardware designs, contains a flaw in how it updates the program counter—the internal register that tracks which instruction to execute next. When certain system registers (SPRs) change, the processor fails to properly update the program counter, causing it to stall and preventing normal program execution. This can lead to system failures, incorrect program flow, and denial of service conditions in deployed systems.
Technical details
The vulnerability is a logic error (CWE-1202) in the OR1200 processor's program counter generation module (or1200_genpc.v), where the CPU address output (cpu_adr_o) is not properly updated when the Next Program Counter (NPC) value changes in the Special Purpose Registers. When an SPR update occurs, the processor stalls the program counter at its previous value instead of advancing to the new NPC value, resulting in incorrect program fetching and execution stalls. This is a hardware-level design flaw that affects the processor's control flow logic. The vulnerability requires no external attack vector—it manifests during normal processor operation when SPR updates occur. An attacker or malicious code executing on the system could trigger this condition, causing the processor to enter an undefined state and stall indefinitely, effectively denying service. There is no patch available as this is a hardware design issue in the open-source OR1200 core; fixes would require design changes and re-synthesis of the hardware.
Affected products
- openRISC OR1200 commit 83ac6b42d73f00daa88a996a1f6738d5a639a105
Timeline
- 2026-08-26: disclosed