An improper handling of RISC-V privileged CSR operations in the XiangShan processor core may allow a local attacker with low privileges to compromise system integrity and availability.

This vulnerability involves the incorrect handling of WPRI (Writes Preserve Values, Reads Ignore Values) fields within the menvcfg register. A local attacker capable of executing privileged CSR operations in Machine mode can trigger unintended modifications to the xstatus register, violating RISC-V architectural constraints.

The exploitation of this flaw poses a significant risk to the underlying hardware security boundary. By manipulating reserved bits, an attacker may achieve unauthorized privilege escalation, potentially leading to a full compromise of the system, including data exposure, unauthorized modification of critical system state, or denial of service. With a CVSS score of 7.8, this vulnerability is classified as High severity, reflecting the potential for total impact on system confidentiality, integrity, and availability if a local attacker gains the necessary execution context.

Immediate Action: Update the XiangShan processor implementation to the commit version containing the fix (5e3dd63) or the latest stable release provided by the vendor.

Proactive Monitoring: Monitor system logs for unusual M-mode trap activity or unexpected state transitions that might indicate attempts to manipulate processor CSRs.

Compensating Controls: Restrict access to privileged execution environments and enforce strict kernel-level security policies to limit the potential for local attackers to reach the vulnerable M-mode operations.

Public Exploit Available: Unknown.

Given the potential for hardware-level compromise, organizations utilizing the XiangShan processor core must prioritize applying the provided patch. While this vulnerability requires local access, the severity of a successful exploit necessitates prompt remediation to maintain the integrity of the hardware trust boundary. Ensure all development and production environments are transitioned to the corrected firmware version immediately.