CVE-2026-29644

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-29644", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-21T17:59:06.506Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-04-21T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-21T14:06:05.088Z"}, "descriptions": [{"lang": "en", "value": "XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA (Physical Memory Attribute) CSR state. Though the RISC-V privileged specification requires an illegal-instruction exception for non-existent/illegal CSR accesses, affected XiangShan versions may still propagate such writes to replicated PMA configuration state. Local attackers able to execute code on the core (privilege context depends on system integration) can exploit this to tamper with memory-attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on how PMA enforces platform security and isolation boundaries."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/OpenXiangShan/XiangShan/issues/3959"}, {"url": "https://docs.riscv.org/reference/isa/priv/priv-csrs.html"}, {"url": "https://github.com/OpenXiangShan/XiangShan/commit/2b1f9796aa98597e5eeac32e5bb1418496987ca4"}, {"url": "https://github.com/OpenXiangShan/XiangShan/commit/edb1dfaf7d290ae99724594507dc46c2c2125384"}, {"url": "https://xiangshan-doc-test.readthedocs.io/next/memory/mmu/pmp_pma/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "references": [{"url": "https://github.com/OpenXiangShan/XiangShan/issues/3959", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T17:58:59.548912Z", "id": "CVE-2026-29644", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T17:59:06.506Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-29644", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T17:58:59.548912Z"}}}], "references": [{"url": "https://github.com/OpenXiangShan/XiangShan/issues/3959", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T17:51:18.870Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/OpenXiangShan/XiangShan/issues/3959"}, {"url": "https://docs.riscv.org/reference/isa/priv/priv-csrs.html"}, {"url": "https://github.com/OpenXiangShan/XiangShan/commit/2b1f9796aa98597e5eeac32e5bb1418496987ca4"}, {"url": "https://github.com/OpenXiangShan/XiangShan/commit/edb1dfaf7d290ae99724594507dc46c2c2125384"}, {"url": "https://xiangshan-doc-test.readthedocs.io/next/memory/mmu/pmp_pma/"}], "descriptions": [{"lang": "en", "value": "XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA (Physical Memory Attribute) CSR state. Though the RISC-V privileged specification requires an illegal-instruction exception for non-existent/illegal CSR accesses, affected XiangShan versions may still propagate such writes to replicated PMA configuration state. Local attackers able to execute code on the core (privilege context depends on system integration) can exploit this to tamper with memory-attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on how PMA enforces platform security and isolation boundaries."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-21T14:06:05.088Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29644", "state": "PUBLISHED", "dateUpdated": "2026-04-21T17:59:06.506Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-21T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA (Physical Memory Attribute) CSR state. Though the RISC-V privileged specification requires an illegal-instruction exception for non-existent/illegal CSR accesses, affected XiangShan versions may still propagate such writes to replicated PMA configuration state. Local attackers able to execute code on the core (privilege context depends on system integration) can exploit this to tamper with memory-attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on how PMA enforces platform security and isolation boundaries."}], "id": "CVE-2026-29644", "lastModified": "2026-06-17T10:29:50.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29644", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T17:58:59.548912Z", "version": "2.0.3"}}]}, "published": "2026-04-21T15:16:36.090", "references": [{"source": "cve@mitre.org", "url": "https://docs.riscv.org/reference/isa/priv/priv-csrs.html"}, {"source": "cve@mitre.org", "url": "https://github.com/OpenXiangShan/XiangShan/commit/2b1f9796aa98597e5eeac32e5bb1418496987ca4"}, {"source": "cve@mitre.org", "url": "https://github.com/OpenXiangShan/XiangShan/commit/edb1dfaf7d290ae99724594507dc46c2c2125384"}, {"source": "cve@mitre.org", "url": "https://github.com/OpenXiangShan/XiangShan/issues/3959"}, {"source": "cve@mitre.org", "url": "https://xiangshan-doc-test.readthedocs.io/next/memory/mmu/pmp_pma/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/OpenXiangShan/XiangShan/issues/3959"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "edb1dfaf7d290ae99724594507dc46c2c2125384"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "xiangshan", "vendor": "openxiangshan"}], "analysis": {"en": {"generated_at": "2026-04-22T07:16:40.787070+00:00", "value": {"mitigation_remediation": ["Update XiangShan to a firmware version that omits commit edb1dfaf7d290ae99724594507dc46c2c2125384 or reverts to a pre\u2011vulnerable state.", "Enforce strict access control on CSR writes, limiting non\u2011privileged code from accessing CA\u2011controlled CSRs to address the underlying CWE\u2011284.", "Configure PMP protections to restrict write access to critical memory attribute registers and enable monitoring for unauthorized PMA modifications."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected hosts are all systems that implement the XiangShan processor and rely on its default PMA configuration. Versions containing the commit edb1dfaf7d290ae99724594507dc46c2c2125384 are impacted; newer releases that incorporate the fix are not affected. No other vendors are implicated.", "description_and_impact": "The vulnerability resides in the XiangShan open\u2011source RISC\u2011V processor. An improper gating of the distributed CSR write\u2011enable path allows illegal write attempts to alter the Physical Memory Attribute (PMA) CSR state. The RISC\u2011V privileged specification requires an illegal\u2011instruction exception when a non\u2011existent or illegal CSR is accessed, but affected XiangShan versions propagate these writes to replicated PMA configuration. The ability to tamper with memory\u2011attribute enforcement can lead to privilege escalation, information disclosure, or denial of service, depending on how PMAs enforce platform security and isolation boundaries.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in KEV. The attack vector is local \u2013 an attacker must already have the ability to execute code on the core. Based on the description, it is inferred that the attacker can write to privileged CSRs that control memory attributes, thereby manipulating PMA settings. This can undermine isolation guarantees and elevate privileges, with the exact impact depending on the platform\u2019s security configuration."}}}}, "created": "2026-04-21T16:30:40.492421+00:00", "title": "Improper CSR Write Gating Enables Unauthorized PMA Modification in XiangShan RISC\u2011V Processor", "updated": "2026-04-22T07:30:11.610326+00:00", "vendors": ["openxiangshan", "openxiangshan$PRODUCT$xiangshan"]}