CWE-1332: Improper Handling of Faults that Lead to Instruction Skips

Description:
The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.

Extended Description:
The operating conditions of hardware may change
              in ways that cause unexpected behavior to occur,
              including the skipping of security-critical CPU
              instructions. Generally, this can occur due to
              electrical disturbances or when the device operates
              outside of its expected conditions. 
			   In practice, application code may contain
			  conditional branches that are security-sensitive (e.g.,
			  accepting or rejecting a user-provided password). These
			  conditional branches are typically implemented by a
			  single conditional branch instruction in the program
			  binary which, if skipped, may lead to effectively
			  flipping the branch condition - i.e., causing the wrong
			  security-sensitive branch to be taken. This affects
			  processes such as firmware authentication, password
			  verification, and other security-sensitive decision
			  points. 
			   Attackers can use fault injection techniques to
			  alte

Affected languages: Not Language-Specific
Affected technologies: System on Chip
Parent weaknesses: CWE-1384

Consequences:
  - Confidentiality: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: This weakness can be found using automated static analysis once a developer has indicated which code paths are critical to protect.
  - Simulation / Emulation: This weakness can be found using automated dynamic analysis. Both emulation of a CPU with instruction skips, as well as RTL simulation of a CPU IP, can indicate parts of the code that are sensitive to
  - Manual Analysis: This weakness can be found using manual (static) analysis. The analyst has security objectives that are matched against the high-level code. This method is less precise than emulation, especially if t

Mitigations:
  - [Architecture and Design] Design strategies for ensuring safe failure if
                        inputs, such as Vcc, are modified out of acceptable
                        ranges.
  - [Architecture and Design] Design strategies for ensuring safe behavior if
                        instructions attempt to be skipped.
  - [Architecture and Design] Identify mission critical secrets that should
                          be wiped if faulting is detected, and design a
                          mechanism to do the deletion.
  - [Implementation] Add redundancy by performing an operation
                          multiple times, either in space or time, and perform
                          majority voting. Additionally, make conditional
                          instruction timing unpredictable.

Demonstrative examples:
A smart card contains authentication credentials that are used as authorization to enter a building. The credentials are only accessible when a correct PIN is presented to the card.
There are several ways this weakness could be fixed.
The card emits the credentials when a voltage anomaly is injected into the power line to the device at a particular time after providing an incorrect PIN to the card, causing the internal program to accept the incorrect PIN.
add an internal filter or internal power supply in series with the power supply pin on the device 
			       add sensing circuitry to reset the device if out of tolerance conditions are detected 
			       add additional execution sensing circuits to monitor the execution order for anomalies and abort the action or reset the device under 

Real-world examples:
  - CVE-2019-15894: fault injection attack bypasses the verification mode, potentially allowing arbitrary code execution.