CWE-1256: Improper Restriction of Software Interfaces to Hardware Features

It is frequently assumed that physical attacks
such as fault injection and side-channel analysis
require an attacker to have physical access to the
target device. This assumption may be false if the
device has improperly secured power management features,
or similar features. For mobile devices, minimizing
power consumption is critical, but these devices run a
wide variety of applications with different performance
requirements. Software-controllable mechanisms to
dynamically scale device voltage and frequency and
monitor power consumption are common features in today's
chipsets, but they also enable attackers to mount fault
injection and side-channel attacks without having
physical access to the device.

Fault injection attacks involve strategic
manipulation of bits in a device to achieve a desired
effect such as skipping an authentication step,
elevating privileges, or altering the output of a
cryptographic operation. Manipulation of the device
clock and voltage supply is a well-known technique to
inject faults and is cheap to implement with physical
device access. Poorly protected power management
features allow these attacks to be performed from
software. Other features, such as the ability to write
repeatedly to DRAM at a rapid rate from unprivileged
software, can result in bit flips in other memory
locations (Rowhammer, [REF-1083]).

Side channel analysis requires gathering
measurement traces of physical quantities such as power
consumption. Modern processors often include power
metering capabilities in the hardware itself (e.g.,
Intel RAPL) which if not adequately protected enable
attackers to gather measurements necessary for
performing side-channel attacks from software.