CVE-2025-63384
Chipsalliance Rocketchip ≤ 1.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-63384 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Chipsalliance Rocketchip. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-3 (Security Function Isolation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-50785
Vulnerability Data
A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP…
more
bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SRET instruction flaw allows an attacker in M-mode to retain M-mode privileges instead of downgrading to S-mode, directly enabling privilege escalation (T1068) by abusing the broken privilege transition mechanism.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces correct privilege-level transitions on SRET so that the processor cannot remain in M-mode when sstatus.SPP requires downgrade to S-mode.
Requires isolation of security functions (privilege modes) so that a flawed SRET implementation cannot allow M-mode code to execute with retained higher privileges.
Verifies integrity of processor firmware and configuration, enabling detection of the incorrect privilege state left by a defective SRET instruction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.