What is CVE-2021-40507?

CVE-2021-40507 is a critical-severity vulnerability in Openrisc Or1200, classified under Improper Authentication. CVSS score: 9.8/10. Published 2023-04-18.

How severe is CVE-2021-40507?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Openrisc Or1200

CVE-2021-40507

An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated correctly for the subtract instruction, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.

Vulnerability class: Broken Authentication

EPSS: 0.007 (50.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Patch)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2021-40507?: CVE-2021-40507 is a critical-severity vulnerability in Openrisc Or1200, classified under Improper Authentication. CVSS score: 9.8/10. Published 2023-04-18.
How severe is CVE-2021-40507?: Critical severity. CVSS v3 base score is 9.8 out of 10.