CVE-2026-29648: OpenXiangShan NEMU Privilege Escalation

CVE-2026-29648 Overview

CVE-2026-29648 is a privilege escalation vulnerability affecting OpenXiangShan NEMU, a RISC-V emulator. When the Smstateen extension is enabled, clearing the mstateen0.ENVCFG bit does not correctly restrict access to henvcfg and senvcfg Control and Status Registers (CSRs). This improper access control allows less-privileged code to read or write these CSRs without triggering the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.

Critical Impact

Less-privileged code can bypass privilege isolation controls to access restricted CSRs, potentially compromising security boundaries in virtualized RISC-V environments.

Affected Products

• OpenXiangShan NEMU (RISC-V emulator with Smstateen extension enabled)

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-29648 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2026-29648

Vulnerability Analysis

This vulnerability stems from improper privilege management (CWE-269) in the Smstateen extension implementation within OpenXiangShan NEMU. The Smstateen extension in RISC-V is designed to provide machine-mode and hypervisor-mode software with the ability to control which state can be accessed by less-privileged modes. The mstateen0 register contains enable bits that, when cleared, should prevent lower privilege levels from accessing certain CSRs.

The flaw specifically affects the ENVCFG bit in mstateen0. When this bit is cleared, access to henvcfg (hypervisor environment configuration) and senvcfg (supervisor environment configuration) should be prohibited for supervisor and user modes, causing an illegal instruction exception when attempted. However, due to this vulnerability, the access control check is not properly enforced, allowing unauthorized CSR access.

This type of vulnerability is particularly concerning in virtualized environments where proper privilege separation is essential for maintaining security boundaries between virtual machines and the hypervisor.

Root Cause

The root cause is an implementation error in the access control logic for CSR permissions when the Smstateen extension is enabled. The NEMU emulator fails to properly check the mstateen0.ENVCFG bit before allowing access to the henvcfg and senvcfg registers, resulting in a privilege boundary bypass. According to the RISC-V Privileged Architecture specification, when mstateen0.ENVCFG is set to zero, any attempt by S-mode or HS-mode software to access senvcfg or henvcfg should raise an illegal instruction exception.

Attack Vector

An attacker operating in supervisor mode (S-mode) or user mode within a NEMU-emulated environment can exploit this vulnerability to:

1. Read restricted CSR values: Access henvcfg and senvcfg registers to obtain sensitive configuration information about the hypervisor or supervisor environment
2. Write to restricted CSRs: Modify environment configuration registers to alter system behavior, potentially enabling additional attack vectors
3. Bypass isolation controls: Circumvent the intended state-enable based isolation mechanisms, undermining the security model of virtualized deployments

The vulnerability requires local access to the emulated RISC-V system with at least user-level privileges. The attack can be performed through standard CSR read/write instructions (csrr, csrw, csrrw, etc.) targeting the affected registers.

For detailed technical information on the vulnerability, refer to the GitHub NEMU Issue #690 and the RISC-V Privileged State Documentation.

Detection Methods for CVE-2026-29648

Indicators of Compromise

• Unexpected successful CSR access operations to henvcfg or senvcfg registers from lower-privileged code when mstateen0.ENVCFG is cleared
• Absence of expected illegal instruction exceptions when supervisor/user mode code attempts to access restricted CSRs
• Anomalous changes to environment configuration registers that were not initiated by machine-mode or authorized hypervisor-mode software

Detection Strategies

• Monitor CSR access patterns in NEMU logs for unauthorized reads or writes to henvcfg and senvcfg registers
• Implement privilege boundary testing by attempting CSR access from lower privilege levels with mstateen0.ENVCFG cleared and verifying exceptions are properly raised
• Enable detailed instruction tracing in NEMU to identify CSR operations that bypass expected access controls

Monitoring Recommendations

• Audit NEMU configurations to ensure Smstateen extension behavior aligns with RISC-V specifications
• Deploy runtime monitoring for privilege escalation attempts in emulated RISC-V environments
• Review system logs for any unauthorized modifications to environment configuration registers

How to Mitigate CVE-2026-29648

Immediate Actions Required

• Update OpenXiangShan NEMU to the latest version that includes the fix for this vulnerability
• Review the GitHub XiangShan Pull Request #3978 for patch details and apply the corresponding NEMU update
• If running virtualized workloads on affected NEMU versions, consider temporarily disabling the Smstateen extension until the patch is applied

Patch Information

The vulnerability has been addressed by the OpenXiangShan project. Users should update their NEMU installation to incorporate the fix. The patch ensures that access control checks for henvcfg and senvcfg CSRs properly respect the mstateen0.ENVCFG bit state, raising illegal instruction exceptions when appropriate.

For patch details, see the GitHub XiangShan Pull Request #3978 and related NEMU repository updates.

Workarounds

• Disable the Smstateen extension if not required for your use case by modifying NEMU configuration
• Implement additional software-level access controls in hypervisor or supervisor code to validate CSR access permissions
• Restrict execution of untrusted code in NEMU-emulated environments until the patch is applied