CVE-2026-29642

A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as "writes preserve values, reads ignore values," i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.riscv.org/reference/isa/priv/machine.html
https://docs.riscv.org/reference/isa/priv/priv-csrs.html
https://github.com/OpenXiangShan/XiangShan/commit/5e3dd63
https://github.com/OpenXiangShan/XiangShan/issues/3934

Configurations

No configuration.

History

No history.

Information

Published : 2026-04-20 21:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-29642

Mitre link : CVE-2026-29642

CVE.ORG link : CVE-2026-29642

JSON object : View

Products Affected

No product.

CWE

CWE-1244

Internal Asset Exposed to Unsafe Debug Access Level or State

{"id": "CVE-2026-29642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T13:51:42.441940Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-04-20T21:16:19.393", "references": [{"url": "https://docs.riscv.org/reference/isa/priv/machine.html", "source": "cve@mitre.org"}, {"url": "https://docs.riscv.org/reference/isa/priv/priv-csrs.html", "source": "cve@mitre.org"}, {"url": "https://github.com/OpenXiangShan/XiangShan/commit/5e3dd63", "source": "cve@mitre.org"}, {"url": "https://github.com/OpenXiangShan/XiangShan/issues/3934", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1244"}]}], "descriptions": [{"lang": "en", "value": "A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as \"writes preserve values, reads ignore values,\" i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields."}], "lastModified": "2026-06-17T10:29:50.150", "sourceIdentifier": "cve@mitre.org"}