cva6 vulnerabilities and fixes

Recent CVEs affecting cva6, with upgrade or downgrade steps. 10 tracked.

cva6 has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-07-18. Highest priority: CVE-2022-34635 (score 59/100).

• CVE-2022-34641 MEDIUM 5.5 MITIGATE MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b
• CVE-2022-34640 MEDIUM 5.5 MITIGATE The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorre
• CVE-2022-34639 MEDIUM 5.5 MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which c
• CVE-2022-34637 MEDIUM 5.5 MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal vi
• CVE-2022-34636 MEDIUM 5.5 MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b
• CVE-2022-34635 CRITICAL 9.8 MITIGATE The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.
• CVE-2022-34634 MEDIUM 5.5 MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instruction
• CVE-2022-34633 MEDIUM 5.5 MITIGATE CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma inst
• CVE-2022-33023 HIGH 7.5 MITIGATE CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instruct
• CVE-2022-33021 HIGH 7.5 MITIGATE CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.

FAQ

How do I fix cva6 vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is cva6 being exploited right now?

None of the tracked cva6 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which cva6 CVE should I patch first?

CVE-2022-34635 currently ranks highest (59/100): The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus..

RSS feed for cva6 · ← Back to latest CVEs