CWE-1332: Improper Handling of Faults that Lead to Instruction Skips
Description
The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
Submission Date :
Oct. 14, 2020, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
Riscure
Extended Description
The operating conditions of hardware may change in ways that cause unexpected behavior to occur, including the skipping of security-critical CPU instructions. Generally, this can occur due to electrical disturbances or when the device operates outside of its expected conditions.
In practice, application code may contain conditional branches that are security-sensitive (e.g., accepting or rejecting a user-provided password). These conditional branches are typically implemented by a single conditional branch instruction in the program binary which, if skipped, may lead to effectively flipping the branch condition - i.e., causing the wrong security-sensitive branch to be taken. This affects processes such as firmware authentication, password verification, and other security-sensitive decision points.
Attackers can use fault injection techniques to alter the operating conditions of hardware so that security-critical instructions are skipped more frequently or more reliably than they would in a "natural" setting.
Example - 1
A smart card contains authentication credentials that are used as authorization to enter a building. The credentials are only accessible when a correct PIN is presented to the card.
The card emits the credentials when a voltage anomaly is injected into the power line to the device at a particular time after providing an incorrect PIN to the card, causing the internal program to accept the incorrect PIN.There are several ways this weakness could be fixed.
<xhtml_ul><xhtml_li>add an internal filter or internal power supply in series with the power supply pin on the device</xhtml_li><xhtml_li>add sensing circuitry to reset the device if out of tolerance conditions are detected</xhtml_li><xhtml_li>add additional execution sensing circuits to monitor the execution order for anomalies and abort the action or reset the device under fault conditions</xhtml_li></xhtml_ul>Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.