2066
Fault injection attacks involve strategic manipulation of bits in a device to achieve a desired
effect such as skipping an authentication step, elevating privileges, or altering the output of a
cryptographic operation. Manipulation of the device clock and voltage supply is a well-known
technique to inject faults and is cheap to implement with physical device access. Poorly protected
power management features allow these attacks to be performed from software. Other features,
such as the ability to write repeatedly to DRAM at a rapid rate from unprivileged software, can
result in bit flips in other memory locations (Rowhammer, [REF-1083]).
Side channel analysis requires gathering measurement traces of physical quantities such as power
consumption. Modern processors often include power metering capabilities in the hardware itself
(e.g., Intel RAPL) which if not adequately protected enable attackers to gather measurements
necessary for performing side-channel attacks from software.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 285 Improper Authorization 684
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : Memory Hardware (Prevalence = Undetermined)
Technology : Power Management Hardware (Prevalence = Undetermined)
Technology : Clock/Counter Hardware (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Memory
Modify Application Data
Bypass Protection Mechanism
Detection Methods
Manual Analysis
Perform a security evaluation of system-level architecture and design with software-aided
physical attacks in scope.
Automated Dynamic Analysis
Use custom software to change registers that control clock settings or power settings to try
to bypass security locks, or repeatedly write DRAM to try to change adjacent locations. This
can be effective in extracting or changing data. The drawback is that it cannot be run before
manufacturing, and it may require specialized software.
Effectiveness = Moderate
CWE Version 4.14
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features