Full Report
Eight years on, we're still paying to hide the future glimpsed during speculative execution
Analysis Summary
# Vulnerability: Spectre Variants on Commercial RISC-V Processors
## CVE Details
* **CVE ID:** Not explicitly assigned in the text (Spectre variants are typically tracked under historical IDs: CVE-2017-5753, CVE-2017-5715, CVE-2018-3639).
* **CVSS Score:** N/A (Historically ~5.6 to 7.1 for Spectre variants).
* **Severity:** High (Based on the ability to leak arbitrary kernel memory).
* **CWE:** CWE-1037 (Processor Speculative Execution Error), CWE-200 (Exposure of Sensitive Information).
## Affected Systems
* **Products:** Commercial Out-of-Order (OoO) RISC-V Processors.
* **Versions:**
* **SiFive:** P550
* **T-Head (Alibaba):** Xuantie C910 and C920
* **Configurations:** Systems running these processors in environments requiring memory isolation (e.g., Linux), particularly where speculative execution is enabled for performance.
## Vulnerability Description
Researchers have confirmed that the RISC-V architecture is susceptible to the same speculative execution flaws that historically affected x86 and ARM. The vulnerability arises because high-performance RISC-V chips predict instruction paths (speculation) to improve speed. If a prediction is incorrect, the processor rolls back the state, but side effects remain in the microarchitectural state (like caches). Specifically, the researchers demonstrated four variants:
1. **Spectre-PHT:** Mistraining the Pattern History Table.
2. **Spectre-BTB:** Poisoning the Branch Target Buffer.
3. **Spectre-RSB:** Attacking the Return Stack Buffer.
4. **Spectre-STL:** Exploiting mispredicted Store-to-Load forwarding.
## Exploitation
* **Status:** PoC available. Researchers demonstrated a leak of arbitrary Linux kernel memory on the Xuantie C910.
* **Complexity:** High (Requires sophisticated cache timing analysis).
* **Attack Vector:** Local (Requires the ability to execute code on the target system to leak memory from higher-privileged contexts).
* **Performance:** Achieved up to 100% recall with 97% precision at a rate of 338 B/s.
## Impact
* **Confidentiality:** High (Leaking of kernel memory, passwords, or encryption keys).
* **Integrity:** None.
* **Availability:** None.
## Remediation
### Patches
* **Linux Kernel:** Three patches have been merged into the mainline Linux kernel; two others are currently under review.
* **SiFive:** Reported to have addressed P550-specific findings.
* **T-Head (Alibaba):** Committed to publishing ad-hoc speculation barriers for their processors.
### Workarounds
* **In-Order Processing:** Use in-order RISC-V cores (e.g., SiFive U74, Xuantie C906/C908) which do not appear vulnerable to these specific attacks.
* **Software Mitigation:** Implementation of architectural primitives and speculation barriers (similar to IBRS/IBPB on x86), though these are currently fragmented in the RISC-V ecosystem.
## Detection
* **Indicators of Compromise:** Extremely difficult to detect as the exploit leaves no traces in standard system logs.
* **Detection Methods:** Hardware performance counters may show unusual cache miss patterns or branch mispredictions, though the paper notes a current lack of "introspection interfaces" in RISC-V hardware to observe these features effectively.
## References
* **Academic Paper:** "Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors" (Usenix Security '26).
* **Link:** hxxps[:]//www[.]usenix[.]org/conference/usenixsecurity26/presentation/gerlach
* **Vendor Info:** hxxps[:]//riscv[.]org/blog/europe-achieves-a-key-milestone-with-the-europes-first-out-of-order-risc-v-processor-chip-with-the-eprocessor-project/