2126
exception_o.tval = commit_instr_i[0].ex.tval;
end
The above vulnerable code checks for CSR interrupts and gives them precedence over any other
exception. However, the interrupts should not occur when the processor runs a series of atomic
instructions. In the above vulnerable code, the required check must be included to ensure the
processor is not in the middle of a series of atomic instructions.
Refrain from interrupting if the intention is to commit an atomic instruction that should not be
interrupted. This can be done by adding a condition to check whether the current committing
instruction is atomic. [REF-1343]
Example Language: Verilog (Good)
if (csr_exception_i.valid && csr_exception_i.cause[63] && !amo_valid_commit_o && commit_instr_i[0].fu != CSR) begin
exception_o = csr_exception_i;
exception_o.tval = commit_instr_i[0].ex.tval;
end
Observed Examples
Reference Description
CVE-2021-26339 A bug in AMD CPU's core logic allows a potential DoS by using a specific x86
instruction sequence to hang the processor
https://www.cve.org/CVERecord?id=CVE-2021-26339
CVE-1999-1476 A bug in some Intel Pentium processors allow DoS (hang) via an invalid
"CMPXCHG8B" instruction, causing a deadlock
https://www.cve.org/CVERecord?id=CVE-1999-1476
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1201 Core and Compute Issues 1194 2471
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Related Attack Patterns
CAPEC-ID Attack Pattern Name
212 Functionality Misuse
References
[REF-1094]Christopher Domas. "Breaking the x86 ISA". < https://github.com/xoreaxeaxeax/
sandsifter/blob/master/references/domas_breaking_the_x86_isa_wp.pdf >.
[REF-1108]Intel Corporation. "Deep Dive: Retpoline: A Branch Target Injection Mitigation". <
https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/
overview.html >.2023-04-07.
[REF-1323]"Cyrix coma bug". 2006 March 2. Wikipedia. < https://en.wikipedia.org/wiki/
Cyrix_coma_bug >.
[REF-1324]Gary Wheeler. "Undocumented M6800 Instructions". 1977 December. < https://
spivey.oriel.ox.ac.uk/wiki/images-corner/1/1a/Undoc6800.pdf >.2023-04-20.
[REF-1331]Robert R. Collins. "The Pentium F00F Bug". 1998 May 1. < https://www.drdobbs.com/
embedded-systems/the-pentium-f00f-bug/184410555 >.2023-04-25.
CWE Version 4.14
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory