CVE-2025-51675: openRISC OR1200 Program Counter DoS Flaw

CVE-2025-51675 Overview

CVE-2025-51675 affects the openRISC OR1200 soft-core processor at commit 83ac6b. The vulnerability stems from an inaccurate update of program counter (PC) values when Special-Purpose Register (SPR) changes occur. This inconsistency can drive the processor into an invalid execution state, resulting in a Denial of Service (DoS) condition. The issue was documented as part of the George Mason University CVE Project focused on hardware description language fuzzing.

Critical Impact
An attacker able to influence SPR writes can desynchronize the program counter, halting instruction flow and causing the OR1200 core to become unresponsive.

Affected Products

openRISC OR1200 soft-core processor at commit 83ac6b
Downstream SoC designs integrating the affected OR1200 revision
FPGA and ASIC deployments built from the vulnerable commit

Discovery Timeline

2026-08-26 - CVE-2025-51675 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-51675

Vulnerability Analysis

The OR1200 is an open-source 32-bit RISC processor implementation compliant with the OpenRISC 1000 architecture. It exposes a set of Special-Purpose Registers (SPRs) used for exception handling, MMU control, timer management, and program flow. When software writes to certain SPRs, the core must synchronize the program counter to reflect the architectural side effects of that write.

The defect lies in how the OR1200 updates the program counter following an SPR modification. The PC value written back to the pipeline does not accurately reflect the intended architectural state. When the mismatched PC propagates into fetch and decode stages, the pipeline can enter an inconsistent state and stop making forward progress.

Because the flaw resides in the RTL of the processor itself, exploitation does not require memory corruption primitives. Executing a crafted instruction sequence that manipulates SPRs is sufficient to trigger the condition on a vulnerable core.

Root Cause

The root cause is an incorrect PC update path in the OR1200 control logic when SPR values change. The design does not consistently reconcile the PC with SPR-driven control transfers, leaving the core in an undefined execution state. The issue is a hardware logic defect rather than a software-level bug and maps to a Denial of Service weakness class.

Attack Vector

An attacker requires the ability to execute instructions on the OR1200 core, typically through unprivileged code running on the target system. By issuing an SPR write sequence that triggers the faulty PC update, the attacker forces the core into a state where instruction execution halts. In multi-tenant or embedded deployments, this results in a loss of availability for any workload bound to the affected core.

Refer to the George Mason University CVE Project for reproduction details and the fuzzing methodology used to surface the issue.

Detection Methods for CVE-2025-51675

Indicators of Compromise

Unexpected hangs or watchdog resets on OR1200-based cores following execution of guest or unprivileged code
Simulation or emulation traces showing PC values that diverge from the expected instruction stream after l.mtspr operations
Repeated bus inactivity from the core immediately after SPR write instructions

Detection Strategies

Audit RTL against the vulnerable commit 83ac6b to identify use of the affected PC update logic
Run hardware description language fuzzers targeting SPR write sequences during pre-silicon verification
Add assertions in simulation that verify PC coherence after every l.mtspr and exception return instruction

Monitoring Recommendations

Instrument production designs with hardware watchdogs that reset stalled cores and log the last executed instruction
Correlate core hang events with preceding SPR access patterns in system telemetry
Track firmware and application behavior for repeated crashes that align with SPR-heavy code paths

How to Mitigate CVE-2025-51675

Immediate Actions Required

Inventory FPGA bitstreams and ASIC designs that incorporate OR1200 at or near commit 83ac6b
Restrict execution of untrusted code on affected cores until a corrected RTL revision is deployed
Enable hardware watchdogs to recover from core hangs and preserve system availability

Patch Information

No vendor patch commit is listed in the NVD entry at publication time. Integrators should monitor the openRISC OR1200 upstream repository for a fix that corrects the PC update behavior on SPR writes, and rebuild synthesized designs once a validated commit is available.

Workarounds

Constrain guest workloads to prevent execution of arbitrary l.mtspr sequences where feasible
Wrap SPR-modifying code in privileged, audited routines and validate PC state through software checks
Deploy watchdog timers and automatic core reset logic to mitigate the availability impact of a triggered hang

bash

# Configuration example
# Rebuild OR1200 from a corrected revision once available
git clone https://github.com/openrisc/or1200.git
cd or1200
git checkout <fixed-commit>
# Re-run synthesis and verification against SPR/PC assertions before deployment