Term · Safety & Security
Fault injection attack
Deliberately disturbing a chip with voltage, clock, electromagnetic, laser or temperature stress so that it skips an instruction, corrupts a value or mis-evaluates a check, then exploiting the faulty behaviour to bypass security.
- Also known as
- Active attack, FI
- Type
- Term
- Domain
- Safety & Security, Hardware attacks
Notes
A single skipped compare can turn a failed signature check into a successful boot, so secure boot uses redundant checks.
Overview
A fault injection attack is a hardware attack in which an adversary deliberately disturbs a chip while it runs, for example with a voltage or clock glitch, an electromagnetic pulse or a laser, so that it skips an instruction or corrupts data and a security check gives the wrong answer. The goal is usually to bypass secure boot, unlock debug access, read out protected memory or extract cryptographic keys. It needs physical access to the device, but the equipment involved is now widely available.
How it works
Every chip is designed and tested to work within specified conditions of supply voltage, clock frequency and temperature. A fault attack pushes it briefly outside them at a carefully chosen moment. A short dip in the supply voltage or an extra-short clock cycle can stop a register or pipeline from settling in time; an electromagnetic pulse from a small coil near the package can induce currents inside the die; a focused laser on the silicon can flip individual bits but needs precise knowledge of the layout. Running the device too hot or too cold is another lever.
At circuit level these disturbances cause bit faults. In software they appear as skipped instructions, a wrong branch taken, a corrupted comparison, or a wrong value loaded or stored. The simplest and most common fault model is the instruction skip. Attackers aim at the instant when code checks a signature, compares a password or loads a key, varying timing and strength until a glitch succeeds. Faulty cipher outputs can also be analysed mathematically to recover keys, a technique called differential fault analysis.
Defences combine hardware and software. On the hardware side, a root of trust can detect or refuse to run outside normal voltage, clock, temperature or field conditions, and a chip may reset or erase sensitive content when it senses an attack. Software adds redundant checks, flow counters that confirm critical steps really ran, default-fail return values and random delays that make timing harder to hit.
Examples
- Researchers using voltage fault injection to re-enable a hidden manufacturer bootloader on an Nvidia Tegra X2 SoC and extract boot-stage keys.
- Voltage or clock glitching used to bypass the readout protection of a microcontroller's flash memory through its bootloader.
- A glitch timed during TrustZone configuration so that secure and non-secure memory regions are set up wrongly.
- A secure boot routine hardened with duplicated signature checks and a control flow counter, following Trusted Firmware-M guidance.
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 5 pages of the Hub. In each group, the pages that mention it most come first.
Skills
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary