A recent investigation by cybersecurity experts at the CISPA Helmholtz Center for Information Security has uncovered significant security flaws in several commercial RISC-V CPUs. Among these vulnerabilities is a critical issue known as GhostWrite, which enables attackers to write arbitrary data to any location in physical memory from a non-privileged state.
GhostWrite is an unprivileged instruction sequence that provides attackers with the ability to write data to specific physical memory addresses, including those of connected devices. The researchers demonstrated that GhostWrite could be used to read physical memory and execute arbitrary machine-mode code, even within cloud environments, through three distinct end-to-end attack scenarios. Additionally, the RISCVuzz tool has identified two unprivileged instruction sequences that can cause an unrecoverable CPU crash.
The RISC-V architecture, known for its versatility and broad adoption across consumer devices and cloud platforms, has become a focal point for these vulnerabilities. This flexibility has resulted in various hardware implementations with differing features and security practices.
Remarkably, these exploits do not require knowledge of source codes or emulators. By applying differential CPU fuzzing across various vendors’ models, researchers can compare architectural behaviors and uncover such flaws.
Technical Analysis
The GhostWrite vulnerability, discovered in the RISC-V CPU model T-Head XuanTie C910, represents a significant hardware design flaw with serious security implications. It allows for unauthorized access to physical memory and the execution of arbitrary machine-mode code, even in cloud-based environments.
RISCVuzz also uncovered two privileged instruction sequences that can cause irreversible CPU halts, raising substantial security concerns about RISC-V system implementations.
GhostWrite enables attackers with minimal privileges to read and write to any memory location and manipulate peripherals, such as network cards. This vulnerability effectively bypasses all built-in CPU security mechanisms, granting attackers full control over the system.
Addressing this flaw would be challenging, as it would require disabling roughly half of the CPU’s functions, which is impractical.
In contrast to side-channel or transient-execution attacks, GhostWrite is a direct hardware issue resulting from faulty vector extension instructions. This hardware flaw cannot be mitigated through software updates, allowing unprivileged attackers to access any memory location and bypass security features entirely.
Moreover, GhostWrite facilitates the hijacking of hardware devices through memory-mapped I/O (MMIO), enabling unauthorized command execution on these devices.
Another demonstration of the exploit shows how the GhostWrite-based read function can leak sensitive memory contents. For instance, an administrator’s secret password entered into a trusted prompt can be exposed by filling physical memory with page tables, and then using GhostWrite to modify these tables to read the password directly.
The list of affected devices includes:
- Scaleway Elastic Metal RV1 (bare-metal C910 cloud instances)
- Lichee Cluster 4A (compute cluster)
- Lichee Book 4A (laptop)
- Lichee Console 4A (compact laptop)
- Lichee Pocket 4A (gaming console)
- Sipeed Lichee Pi 4A (single-board computer)
- Milk-V Meles (single-board computer)
- BeagleV-Ahead (single-board computer)
The report reveals that differential fuzz testing of RISC-V CPUs uncovered GhostWrite by comparing the behavior of small programs across different processors. The T-Head XuanTie C910, in particular, exhibited unusual behavior by executing an illegitimately encoded vector store instruction without raising the expected exception, indicating a severe physical memory write error that bypasses virtual memory protections.
