riscv-boom SonicBOOM L1 Data Cache timing discrepancy_CVE-2025-8774

2 / 10

LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Description

A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component L1 Data Cache Handler. The manipulation leads to observable timing discrepancy. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2025-8774

Source VulDB

Published Aug 9, 2025 at 20:32

Affected Product

Vendor riscv-boom

Product SonicBOOM

Version 2.2.0

Affected Versions riscv-boom SonicBOOM 2.2.0
riscv-boom SonicBOOM 2.2.1
riscv-boom SonicBOOM 2.2.2
riscv-boom SonicBOOM 2.2.3

CWE Classification

CWE-208 CWE-203

References

{
    "lastseen": "",
    "description": "A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component L1 Data Cache Handler. The manipulation leads to observable timing discrepancy. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2025-08-09T20:32:05.812Z",
    "modified": "2025-08-09T20:32:05.812Z",
    "type": "cve",
    "title": "riscv-boom SonicBOOM L1 Data Cache timing discrepancy",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.319297\nhttps://vuldb.com/?ctiid.319297\nhttps://vuldb.com/?submit.625550\nhttps://github.com/fizz-is-on-the-way/vuls_cpu/tree/master/MSHRush",
    "id": "CVE-2025-8774",
    "bulletinFamily": "",
    "cwe": [
        "CWE-208",
        "CWE-203"
    ],
    "cvelist": null,
    "sourceData": "riscv-boom SonicBOOM 2.2.0\nriscv-boom SonicBOOM 2.2.1\nriscv-boom SonicBOOM 2.2.2\nriscv-boom SonicBOOM 2.2.3",
    "sourceHref": "",
    "cvss": {
        "score": 2,
        "severity": "LOW",
        "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "SonicBOOM",
    "version": "2.2.0",
    "vendor": "riscv-boom",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}