Description
The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
Consequences
Confidentiality, Integrity, Authentication: Bypass Protection Mechanism, Alter Execution Logic, Unexpected State
Depending on the context, instruction skipping can
have a broad range of consequences related to the
generic bypassing of security critical code.
Potential Mitigations
Phase: Architecture and Design
Description:
Design strategies for ensuring safe failure if
inputs such as Vcc are modified out of acceptable
ranges.
Phase: Architecture and Design
Description:
Design strategies for ensuring safe behavior if
instructions attempt to be skipped.
Phase: Architecture and Design
Description:
Identify mission critical secrets that should
be wiped if faulting is detected, and design a
mechanism to do the deletion.
Phase: Implementation
Description:
Add redundancy by performing an operation
multiple times, either in space or time, and perform
majority voting. Additionally, make conditional
instruction timing unpredictable.
Phase: Implementation
Description:
Use redundant operations or canaries to
detect faults.
Phase: Implementation
Description:
Ensure that fault mitigations are strong enough
in practice. For example, a low power detection
mechanism that takes 50 clock cycles to trigger at lower
voltages may be an insufficient security mechanism if
the instruction counter has already progressed with no
other CPU activity occurring.
CVE References
- CVE-2019-15894
- fault injection attack bypasses the verification mode, potentially allowing arbitrary code execution.