CVE-2025-63384
📋 TL;DR
This vulnerability in RISC-V Rocket-Chip allows privilege escalation by failing to properly downgrade from Machine-mode to Supervisor-mode when executing the SRET instruction. This affects systems using vulnerable versions of the Rocket-Chip processor implementation, potentially allowing unauthorized access to privileged resources.
💻 Affected Systems
- RISC-V Rocket-Chip processor implementation
📦 What is this software?
Rocketchip by Chipsalliance
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where an attacker gains persistent Machine-mode privileges, bypassing all security controls and accessing all system resources.
Likely Case
Privilege escalation allowing unauthorized access to supervisor-level resources and potential system instability.
If Mitigated
Limited impact if proper privilege separation and access controls are implemented at higher software layers.
🎯 Exploit Status
Exploitation requires code execution capability to trigger the SRET instruction. The vulnerability disclosure includes technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Rocket-Chip repository for fixes after v1.6
Vendor Advisory: https://github.com/chipsalliance/rocket-chip.git
Restart Required: Yes
Instructions:
1. Update to patched version of Rocket-Chip HDL. 2. Recompile and redeploy affected systems. 3. Verify the fix in hardware implementation.
🔧 Temporary Workarounds
Disable Supervisor Mode Entry
allConfigure systems to avoid using supervisor mode entry points that trigger SRET
System-specific configuration changes in bootloader/OS
🧯 If You Can't Patch
- Implement strict access controls and privilege separation at software layer
- Monitor for unusual privilege escalation attempts and system behavior
🔍 How to Verify
Check if Vulnerable:
Check Rocket-Chip version and verify if SRET instruction behavior matches RISC-V specificationCheck Version:
Check Rocket-Chip repository version or hardware specification documentsVerify Fix Applied:
Test SRET instruction behavior in updated implementation to confirm proper privilege transition📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege mode changes
- Failed supervisor mode transitions
- System crashes after privilege operations
Network Indicators:
- Not applicable - local hardware vulnerability
SIEM Query:
Monitor for privilege escalation events and system mode transition failures