CWE-1256 covers devices whose software-controllable features, such as power and clock management, are not properly restricted. Those features can modify hardware memory or register bits, or let software observe physical side channels. It matters to chip designers, firmware and driver authors, and operating system teams, since the attack surface sits between all of them.
How it happens
A common belief says fault injection and side-channel analysis need physical access. That assumption can be false.
Mobile devices need to minimize power use while running apps with very different performance needs. So chipsets offer software-controllable ways to scale voltage and frequency dynamically and to monitor power consumption. The same controls let an attacker mount fault injection and side-channel attacks without touching the device. Fault injection means manipulating bits to skip an authentication step, elevate privilege or change an output.
MITRE's observed examples read like a short history of the problem:
- CVE-2019-11157, known as Plundervolt: improper conditions checks in voltage settings on some Intel processors may let a privileged user escalate privilege or disclose information locally. See the Gold page.
- CVE-2020-8694, known as the PLATYPUS attack: insufficient access control in the Linux kernel driver for some Intel processors allows information disclosure. See the Gold page.
- CVE-2020-8695: an observable discrepancy in the RAPL interface for some Intel processors allows information disclosure (Gold page).
- CVE-2020-12912: an AMD extension to a Linux service does not require privileged access to the RAPL interface, allowing side-channel attacks (Gold page).
The record also covers Rowhammer, where a program writes repeatedly in a tight loop to a location it is allowed to write, and an adjacent location changes value. MITRE notes that stopping the loop is not always possible, and a real fix means redesigning the RAM to reduce coupling. That is possible for new devices but not for existing ones, and it may cost density.
A third example is a design with software-accessible registers for scaling clock frequency and voltage and no access control on them. Attackers who change clock or voltage on a device under their control can cause register and memory changes and race conditions.
What an attacker gains
The record lists integrity: modifying memory and application data, and bypassing protection mechanisms. A fault injected at the right moment can skip a security check. Side channels can leak secrets.
How to find it
MITRE lists two approaches:
- Manual analysis. Do a security evaluation of the system architecture and design with software-aided physical attacks in scope.
- Automated dynamic analysis. Use custom software to change the registers that control clock or power settings and try to bypass security locks. Also try repeatedly writing DRAM to change adjacent locations.
On the software side, check which users and processes can reach power and frequency interfaces. Several of the CVEs above were about drivers that did not require enough privilege.
How to fix it
MITRE's mitigation for design and implementation is to ensure proper access control protects the software-controllable features that alter physical operating conditions, such as clock frequency and voltage.
For drivers and system software, that means treating RAPL style energy counters and voltage controls as sensitive, requiring privilege to read or change them, and applying vendor updates for the interfaces above. For hardware, security-critical scaling registers belong behind a lock that only trusted code controls, as in the entry's third example where the registers sit in a root of trust.
Quick check
Do fault injection attacks always need physical access?
No. Software-controllable voltage and frequency scaling can let attackers mount them from software.
Why were the RAPL related CVEs listed?
They show power and energy interfaces without enough access control leaking information through side channels.
What is the core fix?
Put proper access control on every software-controllable feature that changes physical operating conditions.
