Submit #992356: SonicBOOM riscv-boom git commit af3023c5ef22d6a19e2f4608b29f61c37419c115 Information Exposure Through Discrepancy

The cache_or_lsu_contention vulnerability is a local resource-contention timing side channel in Berkeley Out-of-Order Machine (BOOM) integrated in Chipyard: secret-selected speculative work leaves different state at branch-update propagation into speculative LSU and cache state while both paths commit the same architectural result. The trigger trains or pressures that state, selects the final branch, transfer, or resource path with a secret bit, and exposes the resulting latency to a cycle-count receiver. An attacker able to run code on the same core can repeat the measurement per bit and recover secret-dependent values; the retained validation recovered 0xdeadbeef across 32 bits with a 591.5-cycle median separation. The impact is a local confidentiality side channel that can expose victim data or activity when the affected microarchitectural state is shared across execution contexts. More detail can be found at https://github.com/fizz-is-on-the-way/cpu_vuls2/blob/main/Boom--cache_or_lsu_contention--boom-boomcore-r928-agg343-path326/CVE-REPORT.md and https://github.com/riscv-boom/riscv-boom/issues/795

• Source: ⚠️ https://github.com/riscv-boom/riscv-boom/issues/795
• User: lcyffizz2 (UID 101461)
• Submission: 09/20/2026 05:55 (1 month ago)
• Moderation: 10/31/2026 17:35 (1 month later)
• Status: Duplicate
• VulDB entry: 319297 [riscv-boom SonicBOOM up to 2.2.3 L1 Data Cache timing discrepancy]
• Points: 0