Ledger Donjon安全研究员成功利用光子发射显微镜和激光故障注入技术，绕过了树莓派RP2350微控制器上永久禁用的安全调试功能1。研究人员通过光子发射显微镜精确定位芯片上DEBUGEN寄存器的位置到微米级精度，随后使用激光脉冲在特定位置设置PROC1和PROC1_SECURE比特位，从而绕过了DEBUG_DISABLE永久标志1。
攻击过程中，研究人员发现虽然DEBUGEN_LOCK机制阻止软件向DEBUGEN寄存器写入，但无法防止激光诱导的比特改变1。通过触发救援重启机制（CTRL.RESCUE_RESTART）在固件执行前停止运行时锁，使其保持在READ_WRITE状态，研究人员最终获得了安全属性的调试访问权限，并从一次性可编程内存中恢复了挑战密钥1。
该攻击需要物理访问芯片、芯片去封装、背面激光照射以及通过SWD调试接口进行操作，完整攻击序列所需的实验室设备成本约为25万美元，同时需要专业硬件安全知识1。研究人员于2026年7月28日向树莓派公司披露了该漏洞1。
Researchers have successfully circumvented permanent security debug restrictions on the Raspberry Pi RP2350 microcontroller using photon-emission microscopy and laser fault injection techniques.1 By precisely locating the DEBUGEN register at micrometer-level accuracy and delivering laser pulses to set the PROC1 and PROC1_SECURE bit positions, the team managed to activate debugging access to security-protected functions and recover cryptographic challenge keys stored in one-time programmable memory.1
The attack exploits a fundamental limitation in the chip's hardware security design: while the DEBUGEN_LOCK mechanism prevents software from modifying debug settings, it cannot protect against laser-induced bit flips.1 The researchers leveraged the device's rescue restart function (CTRL.RESCUE_RESTART), which halts execution before firmware runs, leaving the runtime lock in a persistent READ_WRITE state that enables debug access.1 The complete attack sequence required approximately $250,000 in laboratory equipment, including chip decapsulation capability, backside laser illumination setup, and serial wire debug interface access.1 The vulnerability was disclosed to Raspberry Pi on July 28, 2026.1
评论
还没有评论，欢迎留下第一条。