Executive brief
The openRISC OR1200 processor is an open-source CPU core used in embedded systems and SoCs. A design flaw causes a mismatch between the register-transfer level (RTL) design and synthesized hardware, resulting in incorrect program counter updates and undefined instruction execution. This can cause the processor to stall, fetch wrong instructions, or execute from incorrect memory addresses, disrupting all dependent systems.
Technical details
The vulnerability is a hardware design flaw (CWE-1281: Improper Validation of Specified Quantity in Input) in the OR1200 processor's program counter (PC) update logic. The root cause is an inaccurate update of PC values when the Next Program Counter (NPC) stored in Special Purpose Registers (SPRs) changes; the PC becomes stalled at its previous value instead of advancing. Additionally, when specific instructions fail to execute correctly in the synthesized netlist (e.g., instruction 0x95bf022d), the PC and executed instruction fields remain undefined. The vulnerability is present at the hardware RTL level (or1200_genpc.v and or1200_cpu.v) and manifests only in the synthesized netlist, not in RTL simulation. An attacker or malicious firmware can trigger this by executing code sequences that update the NPC register, causing the processor to stall or execute incorrect instruction streams, compromising system integrity and availability. No patch information is currently available; this appears to be a newly discovered design issue requiring RTL correction and re-synthesis.
Affected products
- openRISC OR1200 commit 83ac6b42d73f00daa88a996a1f6738d5a639a105
Timeline
- 2025-01-27: disclosed: Issue reported on GitHub
- 2026-08-26: advisory: CVE-2025-51679 published