{"id":"CVE-2025-63384","aliases":["EUVD-2025-50785","GHSA-g435-j3hg-9vfh"],"status":"published","title":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the...","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00328,"percentile":0.26305,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2025-11-10T00:00:00Z","modified":"2026-10-28T02:31:07Z","products":[{"vendor":"chipsalliance","product":"rocketchip"}],"references":[{"url":"https://github.com/chipsalliance/rocket-chip.git","tags":["Product","package"]},{"url":"https://github.com/107040503/RISC-V-Vulnerability-Disclosure_SRET","tags":["Exploit","Third Party Advisory","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63384","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g435-j3hg-9vfh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63384.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-63384","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","status":"published","published":"2025-11-10T00:00:00Z","modified":"2025-11-12T20:39:11.448Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-50785","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","status":"published","published":"2025-11-10T00:00:00Z","modified":"2025-11-12T20:39:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:17.986196Z"}],"ghsa":[{"id":"GHSA-g435-j3hg-9vfh","title":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the...","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","status":"published","published":"2025-11-10T21:30:36Z","modified":"2025-11-12T21:32:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:04:46.9648Z"}],"nvd":[{"id":"CVE-2025-63384","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","status":"published","published":"2025-11-10T20:15:49.013Z","modified":"2026-06-17T09:53:03.867Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:11:42.870953Z"}],"osv":[{"id":"CVE-2025-63384","description":"A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.","status":"published","published":"2025-11-10T00:00:00Z","modified":"2026-10-28T02:31:07.830174065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:51.851511Z"}]}}