名稱: Hardware Simulation / Synthesis Mismatch
The hardware design contains structures that are interpreted
differently during synthesis than during simulation, which
cause inconsistencies in security-relevant behavior between
the synthesized implementation and the simulation.
一般資訊
引入方式
適用平台
程式語言
名稱： Verilog (Undetermined)名稱： VHDL (Undetermined)
類別： Hardware Description Language (Undetermined)
架構
類別： Not Architecture-Specific (Undetermined)技術
類別： System on Chip (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Other | Varies by Context |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2025-51678 | The synthesized netlist incorrectly calculates memory addresses and fetches co-processor instructions, potentially causing unintended memory accesses or incorrect custom-instruction execution. |
CVE-2025-51677 | Debug-load requests should return complete load store unit (LSU) data, but the synthesized netlist returned incomplete data, potentially causing incorrect interpretation of memory state. |
CVE-2025-51679 | Instruction execution should update program-counter state correctly, but the synthesized netlist produced incomplete or undefined updates, potentially causing unintended control flow. |
CVE-2025-51675 | The program counter should update when the next-program-counter value changes, but the synthesized netlist allowed stale PC state, potentially causing incorrect instruction fetches or stalls. |
潛在緩解措施
偵測方法
Automated Static Analysis - Source Code
有效性 : ModerateManual Analysis
有效性 : LimitedFormal Verification
有效性 : HighSimulation / Emulation
有效性 : HighFuzzing
有效性 : High漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Since this entry is often resultant, there might be other CWEs that are more appropriate as the root cause, although there might be some gaps. Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
參考資料
REF-1552
RTL Coding Styles That Yield Simulation and Synthesis MismatchesDon Mills, Clifford E. Cummings.
https://www.researchgate.net/profile/Clifford-Cummings/publication/228554783_RTL_Coding_Styles_That_Yield_Simulation_and_Synthesis_Mismatches/links/54bfe9760cf21674ce9ca726/RTL-Coding-Styles-That-Yield-Simulation-and-Synthesis-Mismatches.pdf
REF-1553
SynFuzz: Leveraging Fuzzing of Netlist to Detect Synthesis BugsRaghul Saravanan, Sudipta Paria, Aritra Dasgupta, Venkat Nitin Patnala, Swarup Bhunia, Sai Manoj P. D..
https://arxiv.org/abs/2504.18812
REF-1554
The Dangers of Living with an X (bugs hidden in your Verilog)Mike Turpin.
https://developer.arm.com/documentation/arp0009/a/?lang=en
REF-1555
Standard Gotchas: Subtleties in the Verilog and SystemVerilog Standards That Every Engineer Should KnowStuart Sutherland, Don Mills.
https://sutherland-hdl.com/papers/2006-SNUG-Boston_standard_gotchas_paper.pdf
REF-1556
Lost in Translation: Enabling Confused Deputy Attacks on EDA Software with TransFuzzFlavien Solt, Kaveh Razavi.
https://www.usenix.org/conference/usenixsecurity25/presentation/solt
REF-1557
Yet Another Latch and Gotchas PaperDon Mills.
https://lcdm-eng.com/papers/snug12_Paper_final.pdf
REF-1558
“full_case parallel_case”, the Evil Twins of Verilog SynthesisClifford E. Cummings.
https://csg.csail.mit.edu/6.375/6_375_2009_www/papers/cummings-case-snug99.pdf
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
