CVE-2025-51677: openRISC OR1200 Output Mismatch Vulnerability

CVE-2025-51677 Overview

CVE-2025-51677 affects the openRISC OR1200 CPU core at commit 83ac6b. The issue is an output mismatch between the Register Transfer Level (RTL) description and the synthesized netlist of the or1200 CPU output port. This inconsistency can produce unexpected behavior at runtime because the hardware fabricated from the netlist does not match the logical model verified at RTL. The flaw is tracked under CWE-116: Improper Encoding or Escaping of Output and applies to any System-on-Chip design that integrates the affected OR1200 revision.

Critical Impact
Attackers with network-reachable access to systems built on the vulnerable OR1200 core can trigger integrity and availability failures without authentication or user interaction.

Affected Products

openRISC OR1200 CPU core at commit 83ac6b
Hardware designs and SoC integrations that synthesize the affected OR1200 netlist
Downstream products relying on the mismatched CPU output port behavior

Discovery Timeline

2026-07-17 - CVE-2025-51677 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2025-51677

Vulnerability Analysis

The defect resides in the OR1200 CPU implementation, an open-source 32-bit RISC processor core maintained by the openRISC project. Synthesis of the RTL source into a gate-level netlist produces divergent output behavior at the CPU output port. The RTL simulation and the netlist implementation disagree on the values driven by the port under certain conditions. This class of hardware defect falls under improper output encoding [CWE-116], where the hardware output does not faithfully represent the intended logical state. Because the mismatch is embedded in the CPU core itself, any software or peripheral consuming the affected port receives values inconsistent with the verified RTL model. Research documenting the mismatch is available in the SynFuzz project and the associated ArXiv research paper.

Root Cause

The root cause is a synthesis-induced divergence between the RTL specification and the generated netlist. Synthesis tool behavior, ambiguous coding constructs, or unspecified signal states allow the netlist to legally produce output values that the RTL simulator does not exhibit. The result is a functional equivalence failure at the CPU output port. Additional discussion is captured in the openRISC mor1kx issue comment.

Attack Vector

Exploitation requires the ability to reach code paths on the affected CPU that trigger the mismatched output. Because the CVSS vector describes a network-reachable condition, attackers who can influence workloads executing on the vulnerable core can drive the CPU into states where netlist output diverges from expected values. The consequences include corruption of data emitted from the CPU port and disruption of downstream logic that depends on it. No verified exploit code has been published for this issue. See the ArXiv research paper for the fuzzing methodology used to surface the mismatch.

Detection Methods for CVE-2025-51677

Indicators of Compromise

Unexpected divergence between simulated RTL waveforms and post-synthesis netlist simulation of the or1200 output port
Runtime anomalies on SoCs using the affected OR1200 commit, such as inconsistent bus values or peripheral misbehavior
Formal equivalence checking failures between RTL and netlist for the CPU output port

Detection Strategies

Run logic equivalence checking (LEC) between the RTL and synthesized netlist to identify output port mismatches
Execute gate-level simulation with the same test vectors used during RTL verification and compare outputs
Apply hardware fuzzing techniques described in the SynFuzz research to surface RTL-to-netlist divergences

Monitoring Recommendations

Track the openRISC mor1kx issue tracker for upstream fixes and patch commits
Monitor SoC integration test suites for regression failures tied to the or1200 CPU output port
Log anomalous CPU-to-peripheral bus transactions in silicon validation environments

How to Mitigate CVE-2025-51677

Immediate Actions Required

Inventory all designs, FPGA bitstreams, and ASIC tape-outs that incorporate OR1200 commit 83ac6b
Halt production synthesis flows using the affected commit until an equivalence-verified revision is available
Perform formal equivalence checking on any existing netlists derived from the affected RTL

Patch Information

No official patched commit has been published in the CVE record at the time of writing. Consumers of the OR1200 core should track the openRISC GitHub discussion and apply a corrected RTL revision once released, then re-synthesize and re-verify the netlist against the updated source.

Workarounds

Substitute the affected OR1200 commit with an alternative openRISC implementation such as mor1kx where feasible
Constrain synthesis tool options to eliminate ambiguous inference on the affected output port and re-verify with LEC
Add hardware assertions and runtime checks on consumers of the CPU output port to detect anomalous values

bash

# Example: run logic equivalence check between RTL and netlist
formality -shell -f run_lec.tcl \
  -reference or1200_rtl.v \
  -implementation or1200_netlist.v \
  -report or1200_lec_report.txt