Bug 14 - ROM Controller Single-Bit Digest Comparison Vulnerable to Fault Injection
Legacy reference: Bug #21 in the working set
Security feature bypassed
Secure-boot ROM integrity verification - the digest-match decision that gates execution of the boot ROM
Attack type
Type 2 - physical attacker with fault injection
Finding
The entire ROM digest comparison result rests on a single flip-flop (digest_match_q)
with no redundancy, Hamming protection, or dual-rail encoding:
// rom_ctrl_compare.sv - digest comparison logic
logic digest_match_q;
assign digest_match = digest_match_q;
A single-bit fault (clock glitch, EM pulse, laser) flipping digest_match_q 0-1 makes a
digest mismatch appear as a match - the ROM controller proceeds to execute content that
never passed verification, with machine-mode privileges.
Location or code reference
- hw/ip/rom_ctrl/rtl/rom_ctrl_compare.sv:82 - single flip-flop
matches_qholds the whole digest-match result - hw/ip/rom_ctrl/rtl/rom_ctrl_compare.sv:153-162 - FF update:
matches_d = matches_q && (digest_word == exp_digest_word)- no redundancy
New Tools
Yes - actual-RTL module instantiation (Verilator 4.210):
rom_ctrl_compare_tb.sv instantiates the real rom_ctrl_compare.sv and demonstrates the
single-FF result (see testbench/logs/rtl-test-simulation.log); plus RTL grep evidence
(logs/rtl_evidence.log).
AI Tools
No.
LLM
No.
LLM Details
PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).
Online LLM Details
PLACEHOLDER - to be completed (input/output/total token counts, verification script).
LLM Prompts
PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).
Detection method
Actual-RTL instantiation + static inspection. VCS FI demo (fi21.v): drive a genuine digest
mismatch (matches_q=0), force matches_q=1, observe good_o flips to True while
alert_o stays 0 - fault is silent (see exploit/logs/fi21_run.log:
*** BUG #21 FI CONFIRMED: fault is SILENT ***).
Security impact
Bypasses secure boot entirely. Corrupt the boot ROM image (or fault the comparison after a
clean hash computation) and glitch digest_match_q during the comparison window: the ROM
controller boots attacker-controlled code with M-mode privileges; all downstream security
(Key Manager, LC, OTP) is compromised from the first instruction.
Adversary profile
Type 2 - physical attacker with fault injection (single glitch at the right moment during the boot comparison window).
Proposed mitigation
// Dual-rail / multi-bit encoding with Hamming distance >= 3
logic [4:0] digest_match_encoded; // e.g. Hamming(5,1) code
assign match_valid = (digest_match_encoded == MATCH_ENCODED) &&
(!digest_match_encoded == !MATCH_ENCODED);
Or: redundant comparison with majority vote across multiple registers, plus an alert on disagreement.
CVSSv3.1 score and severity
8.2 - HIGH
CVSSv3.1 Details
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- AV: Physical - fault injection on the device
- AC: Low - one glitch in the comparison window
- PR: None
- S: Changed - crosses from ROM verification into all M-mode software
- C/I/A: High - arbitrary code execution at boot
Attachment links
Located in this repository (GitHub is the cloud storage for the submission):