Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-1319 — Vulnerability Class 3

3 vulnerabilities classified as CWE-1319. AI Chinese analysis included.

CWE-1319 represents a critical hardware security weakness where devices lack adequate defenses against electromagnetic fault injection, allowing attackers to manipulate internal circuit signals. By generating localized, transient magnetic fields near integrated circuits, adversaries can induce transient errors or permanent faults, effectively bypassing security mechanisms or extracting sensitive internal data without physical tampering. This exploitation relies on precise timing and proximity to disrupt normal operation, potentially leading to privilege escalation or information disclosure. To mitigate this risk, developers must implement robust physical shielding, such as Faraday cages, and integrate hardware-level countermeasures like voltage monitors and error detection logic. Additionally, employing cryptographic techniques that verify data integrity during execution can help detect and neutralize faults, ensuring that the device remains resilient against sophisticated electromagnetic attacks targeting its core processing units.

MITRE CWE Description
The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed. Electromagnetic fault injection may allow an attacker to locally and dynamically modify the signals (both internal and external) of an integrated circuit. EM-FI attacks consist of producing a local, transient magnetic field near the device, inducing current in the device wires. A typical EMFI setup is made up of a pulse injection circuit that generates a high current transient in an EMI coil, producing an abrupt magnetic pulse which couples to the target producing faults in the device, which can lead to: Bypassing security mechanisms such as secure JTAG or Secure Boot Leaking device information Modifying program flow Perturbing secure hardware modules (e.g. random number generators)
Common Consequences (1)
Confidentiality, Integrity, Access Control, AvailabilityModify Memory, Read Memory, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Execute Unauthorized Code or Commands
Mitigations (1)
Architecture and Design, Implementation1. Redundancy - By replicating critical operations and comparing the two outputs can help indicate whether a fault has been injected. 2. Error detection and correction codes - Gay, Mael, et al. proposed a new scheme that not only detects faults injected by a malicious adversary but also automatically corrects single nibble/byte errors introduced by low-multiplicity faults. 3. Fail by default codin…
Examples (1)
In many devices, security related information is stored in fuses. These fuses are loaded into shadow registers at boot time. Disturbing this transfer phase with EM-FI can lead to the shadow registers storing erroneous values potentially resulting in reduced security.

Vulnerabilities classified as CWE-1319 represent 3 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.