Laser Fault Injection Vulnerability in RP2350 Microcontroller

• •Ledger Donjon exploited RP2350's Secure Boot using laser fault injection.
• •The attack requires $250,000 in lab equipment and physical access to the chip.
• •Raspberry Pi acknowledged the vulnerability but deemed it non-critical for a chip respin.

Researchers from Ledger Donjon successfully exploited a vulnerability in the RP2350 microcontroller, allowing them to bypass its Secure Boot feature and access secret data stored in One-Time Programmable (OTP) memory. This attack utilized photon-emission microscopy and laser fault injection techniques, requiring approximately $250,000 worth of specialized equipment and physical access to the chip. The RP2350's security features, including secure boot and permanent debug-disable settings, were designed to prevent such exploits. However, the researchers demonstrated that targeted laser pulses could manipulate specific registers to restore debug access. Raspberry Pi acknowledged the findings and confirmed that while the vulnerability exists, it does not warrant a respin of the chip due to the attack's destructive nature and high resource requirements. The RP2350 Hacking Challenge initiated by Raspberry Pi aimed to encourage researchers to test the security of the microcontroller, leading to this discovery. The current status indicates that while the vulnerability is known, it requires significant resources to exploit effectively.