Executive brief
A technical issue was identified in the openRISC OR1200 processor, a hardware design used in various embedded systems. During debugging operations, the processor may fail to correctly retrieve data from memory, leading to incorrect information being sent to the debugging tools. This can prevent engineers from accurately diagnosing system issues and could lead to unpredictable behavior during system maintenance or analysis.
Technical details
A synthesis bug exists in the front-end design of the OR1200 processor, specifically affecting the interface between the Load-Store Unit (LSU) and the Debug Unit. When the Debug Unit requests a memory load operation, the LSU may fail to fully retrieve or provide the requested data, resulting in an 'unknown' (xxxxxxxx) value at the du_lsu_load_dat output port. This discrepancy between the Register Transfer Level (RTL) description and the synthesized gate-level netlist causes a misinterpretation of memory states. The vulnerability was identified using SynFuzz, a differential fuzzing tool designed to detect bugs introduced during the hardware synthesis process. An attacker or researcher with local access to the debugging interface would observe incorrect memory states, undermining the integrity of the debugging process.
Affected products
- openRISC OR1200 processor commit 83ac6b42d73f00daa88a996a1f6738d5a639a105
Timeline
- 2025-01-05: disclosed: Issue reported on GitHub
- 2025-04-26: other: Academic paper detailing SynFuzz findings published on arXiv
- 2026-07-17: advisory: CVE published to NVD