MicroSpark: Testing Voltage Glitches on Intel Microcode

The ability to cause precise faults during the execution of microprograms, e.g., the microcode update routine of a CPU, can constitute a powerful and stealthy primitive to compromise a CPU at the microarchitectural level. However, the complexity of modern CPUs inherently limits the possibility of inducing such controlled faults in microarchitectural components. It is therefore unclear to what extent an attacker might be able to use hardware fault injection attacks against microcode. In this work, we present a robust and reproducible experimental platform that pairs a low-cost glitcher with a corebootbased environment on a "Red Unlocked" Intel Goldmont SoC. Leveraging the low-noise execution environment provided by this setup, as well as the possibility of crafting custom microcode routines due to Red Unlock, we successfully identified previously undocumented fault types, including instruction skips at both the architectural and microarchitectural levels on Apollo Lake CPUs. This provides a foundation for future investigations into Intel microcode security, and the potential for broader applications across various CPU models.