2084
csr_exception_o.valid = 1'b1;
end
end
The vulnerable example code allows the machine exception program counter (MEPC) register to
be accessed from a user mode program by excluding the MEPC from the access control check.
MEPC as per the RISC-V specification can be only written or read by machine mode code. Thus,
the attacker in the user mode can run code in machine mode privilege (privilege escalation).
To mitigate the issue, fix the privilege check so that it throws an Illegal Instruction Exception for
user mode accesses to the MEPC register. [REF-1345]
Example Language: Verilog (Good)
if (csr_we || csr_read) begin
if ((riscv::priv_lvl_t'(priv_lvl_o & csr_addr.csr_decode.priv_lvl) != csr_addr.csr_decode.priv_lvl)) begin
csr_exception_o.cause = riscv::ILLEGAL_INSTR;
csr_exception_o.valid = 1'b1;
end
// check access to debug mode only CSRs
if (csr_addr_i[11:4] == 8'h7b && !debug_mode_q) begin
csr_exception_o.cause = riscv::ILLEGAL_INSTR;
csr_exception_o.valid = 1'b1;
end
end
Observed Examples
Reference Description
CVE-2014-2915 virtualization product does not restrict access to debug and other processor
registers in the hardware, allowing a crash of the host or guest OS
https://www.cve.org/CVERecord?id=CVE-2014-2915
CVE-2021-3011 virtual interrupt controller in a virtualization product allows crash of host by
writing a certain invalid value to a register, which triggers a fatal error instead
of returning an error code
https://www.cve.org/CVERecord?id=CVE-2021-3011
CVE-2020-12446 Driver exposes access to Model Specific Register (MSR) registers, allowing
admin privileges.
https://www.cve.org/CVERecord?id=CVE-2020-12446
CVE-2015-2150 Virtualization product does not restrict access to PCI command registers,
allowing host crash from the guest.
https://www.cve.org/CVERecord?id=CVE-2015-2150
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
680 Exploitation of Improperly Controlled Registers
References
[REF-1340]"Hackatdac19 csr_regfile.sv". 2019. < https://github.com/HACK-EVENT/hackatdac19/
blob/619e9fb0ef32ee1e01ad76b8732a156572c65700/src/csr_regfile.sv#L854:L857 >.2023-06-21.
CWE Version 4.14
CWE-1263: Improper Physical Access Control
CWE-1263: Improper Physical Access Control