Spectre vulnerabilities found on commercial RISC-V chips

Researchers have discovered that certain commercial RISC-V chips are susceptible to Spectre vulnerabilities, a family of security flaws related to speculative execution. These vulnerabilities, previously thought to primarily affect x86 and ARM architectures, can allow attackers to access sensitive data by exploiting how processors predict and execute instructions. This finding challenges the assumption that simpler chip architectures are immune to such sophisticated attacks, with further coverage provided by The Register.

Academic researchers from the CISPA Helmholtz Center for Information Security and KU Leuven have demonstrated that commercially available out-of-order RISC-V processors, specifically the SiFive P550 and T-Head Xuantie C910/C920, are vulnerable to all major Spectre variants. These variants include Spectre-PHT, Spectre-BTB, Spectre-RSB, and Spectre-STL, which exploit different aspects of speculative execution, such as branch prediction and return stack buffers. Proof-of-concept attacks have successfully leaked arbitrary Linux kernel memory from the Xuantie C910 at a rate of 338 B/s.

While software-based defenses exist for other architectures, they do not directly transfer to RISC-V due to the architecture's diversity and lack of introspection interfaces. The researchers emphasize that effective defense requires building new architectural primitives and ecosystem-wide tooling, as RISC-V inherits mature threat models without accumulated hardening. Responsible disclosure has led to some patches being merged into Linux, and vendors like SiFive and T-Head are addressing the findings.

Source: The Register