Executive brief
A flaw was identified in the PicoRV32 processor, a small CPU core used in various hardware designs. The issue involves a mismatch in how the processor handles custom instructions and memory addresses during its manufacturing or synthesis process. This can lead to unpredictable behavior, potentially causing the processor to execute incorrect instructions or fail to process data accurately, which impacts the reliability of the hardware.
Technical details
A vulnerability was discovered in the RISC-V PicoRV32 (specifically commit 87c89a) involving a mismatch between the Register Transfer Level (RTL) design and the synthesized gate-level netlist. The flaw manifests in the processor's memory interface and the PicoRV32 Co-Processor Interface (PCPI). Specifically, address calculations for memory operations may not update accurately, and instructions intended for the co-processor may not be fully fetched into the decode stage. This results in incomplete or incorrect data being forwarded to the co-processor or the retrieval of data from unintended memory locations. An attacker or a specific sequence of instructions could trigger this state, leading to undefined program flow or compromised data integrity. The issue was identified using the SynFuzz differential fuzzing tool.
Affected products
- RISC-V PicoRV32 commit 87c89a
Timeline
- 2025-01-27: disclosed: Issue reported on GitHub repository
- 2026-07-17: advisory: CVE published to NVD