Read Time:1 Minute, 13 Second

Description

The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-1384
CWE-1247

 

Consequences

Confidentiality, Integrity, Authentication: Bypass Protection Mechanism, Alter Execution Logic, Unexpected State

Depending on the context, instruction skipping can
have a broad range of consequences related to the
generic bypassing of security critical code.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Design strategies for ensuring safe failure if
inputs such as Vcc are modified out of acceptable
ranges.

Phase: Architecture and Design

Description: 

Design strategies for ensuring safe behavior if
instructions attempt to be skipped.

Phase: Architecture and Design

Description: 

Identify mission critical secrets that should
be wiped if faulting is detected, and design a
mechanism to do the deletion.

Phase: Implementation

Description: 

Add redundancy by performing an operation
multiple times, either in space or time, and perform
majority voting. Additionally, make conditional
instruction timing unpredictable.

Phase: Implementation

Description: 

Use redundant operations or canaries to
detect faults.

Phase: Implementation

Description: 

Ensure that fault mitigations are strong enough
in practice. For example, a low power detection
mechanism that takes 50 clock cycles to trigger at lower
voltages may be an insufficient security mechanism if
the instruction counter has already progressed with no
other CPU activity occurring.

CVE References

  • CVE-2019-15894
    • fault injection attack bypasses the verification mode, potentially allowing arbitrary code execution.