Targeted Wearout Attacks in Microprocessor Cores

TL;DR

This paper introduces a novel attack method called Targeted Wearout Attack that exploits negative-bias temperature instability in microprocessors to selectively degrade specific functional units, causing targeted errors or data corruption.

Contribution

It presents a new attack framework leveraging aging mechanisms for targeted fault injection in microprocessors, with a case study demonstrating significant wear increase in a RISC-V CPU pipeline.

Findings

Targeted wearout can cause >7x increase in component degradation.

Attacker can induce silent data corruption in victim applications.

The attack requires only user privilege and knowledge of processor internals.

Abstract

Negative-Bias Temperature Instability is a dominant aging mechanism in nanoscale CMOS circuits such as microprocessors. With this aging mechanism, the rate of device aging is dependent not only on overall operating conditions, such as heat, but also on user controllable inputs to the transistors. This dependence on input implies a possible timing fault-injection attack wherein a targeted path of logic is intentionally degraded through the purposeful, software-driven actions of an attacker, rendering a targeted bit effectively stuck. In this work, we describe such an attack mechanism, which we dub a "$\textbf{Targeted Wearout Attack}$", wherein an attacker with sufficient knowledge of the processor core, executing a carefully crafted software program with only user privilege, is able to degrade a functional unit within the processor with the aim of eliciting a particular desired incorrect calculation in a victim application. Here we give a general methodology for the attack. We then demonstrate a case study where a targeted path within the fused multiply-add pipeline in a RISC-V CPU sees a $>7x$ increase in wear over time than would be experienced under typical workloads. We show that an attacker could leverage such an attack, leading to targeted and silent data corruption in a co-running victim application using the same unit.