| ||||
| ||||
![]() Title:Investigating Fault-Induced Misconfiguration of RISC-V PMP and Its Consequences for Isolated Software Execution Environments Conference:ISC 2026 Tags:Fault Injection Attacks, FPGA, Hardware Security, Physical Memory Protection and RISC-V Abstract: We study Fault Injection Attacks (FIA) targeting Physical Memory Protection (PMP). We analyse an extensive clock-glitching campaign on several RISC-V cores. We provide a fine-grained, bit-level characterization of how injected faults corrupt the PMP configuration registers. Then, we develop a theoretical impact analysis of how such physical attack would translate into isolation violations across representative PMP-based software stacks such as TEEs, MultiZone, and Retal-Time Operating Systems (RTOS). Our results show that the fragility of PMP under fault injection does not remain confined to the hardware level but propagates to every isolation layer that depends on it. For instance, across three RISC-V cores (Ibex, VexRISCV and CVA6), more than half of the observed fault effects are bit-flips in the PMP registers that extend a protected region and create memory overlaps. Finally, we highlight 11 concrete exploitation scenarios. Investigating Fault-Induced Misconfiguration of RISC-V PMP and Its Consequences for Isolated Software Execution Environments ![]() Investigating Fault-Induced Misconfiguration of RISC-V PMP and Its Consequences for Isolated Software Execution Environments | ||||
| Copyright © 2002 – 2026 EasyChair |
