RISC-V BOOM CPU L1 Data Cache Write Port Contention Side Channel (MSHRush)

Key Information Vulnerability Name MSHRush Description Vulnerability Type: RISC-V BOOM CPU L1 Data Cache Write Port Contention Side Channel Vulnerability Impact: Attackers can exploit contention on the L1 data cache write port by measuring execution time, thereby leaking sensitive data. BOOM Version Information Core: BOOM (Berkeley Out-of-Order Machine, RISC-V) Version: V2.2.3-210-gd77c2c3f implemented in Chipyard (V1.3.0) BOOM Source Code: GitHub Link Chipyard Source Code: GitHub Link Affected Versions: All versions with a single write port L1 data cache Vendor: UC Berkeley / CHIPS Alliance Vulnerability Details Description: The BOOM CPU L1 data cache array has only one write port, shared between the LoadStore Unit (LSU) and the Miss Status Handling Register (MSHR). When both LSU and MSHR request writes simultaneously, contention occurs. MSHR is given priority, causing delays in MSHR refill (cache miss) operations. Attack Method: Attackers trigger LSU via a series of store instructions, while victim code triggers MSHR refill. By measuring the execution time of the victim function under different secret values, attackers can determine whether contention occurred, thereby inferring the secret value. Impact Vulnerability Type: Microarchitectural Timing Side Channel (Cache Write Port Contention) Attack Type: Local (requires ability to execute code on the same core) Leaked Information: Secret data processed during transient execution (e.g., keys, sensitive memory) Attack Complexity: Feasible if attacker can run code on the same CPU core POC Note: Proof-of-Concept (POC) will not be released. Vendors may request POC by providing an email address.

Goal Reached Thanks to every supporter — we hit 100%!

RISC-V BOOM CPU L1 Data Cache Write Port Contention Side Channel (MSHRush)

More from this source