Can non-malicious faults provoke malicious faults?

Question

I am wondering about this for a long time. With the exponential raising of critical cyber-physical systems (CPS) in our all-day-life (cars, metro, UAVs, ships...), how would an attacker be able to exploit non-malicious faults (i.e. due to the ageing of a component or due to cost restriction or incompetence that may lead to memory bloating / leaking, data fragmentation ...) to create malicious faults?

I am trying to find some sources that would go in favor of my question, i.e. is it possible for an attacker to wait for non-malicious faults to occur in order to exploit them to launch an attack?

The example I have in mind is when you deal with both low assurance components (which have a non-malicious fault rate that may be high) and high assurance ones, where the non-malicious fault rate should be very low.

If you have a low assurance component, prone to fault, on the path of a high assurance one, is it possible for an attacker to exploit the natural faults of a low assurance component to break through the high assurance one?

The main sources I am finding are on fault attacks, which are attacks that provoke faults. I would like to know if there exist some sources on attacks provoked by faults, and if it is reasonable to think of this as a possible way for an attacker to break through a system.

edit: to be more clear, is it possible to use faults of a low assurance component to break through a high assurance one?

Answer 1

I may have found an interesting example by combining some references.

Assume that we have a low assurance function that is related to a high assurance one (they share the same memory). This makes sense in a car, where infotainment functions (low assurance) may interact with perception functions (high assurance) to display data to the user.

Because the low assurance function is, well, of low assurance, the designer decided to put a low of security mechanisms for this function, to avoid an attacker to use it to access the memory and then to access the high assurance function.

However, the low assurance function is subject to dangling pointers fault, that is a common fault due to incompetence / not attentive developer. A dangling pointer appears when an object is destroyed, but the point still references the memory address used by this object. Hence, this pointer may be used to access data that should not be accessed (i.e., privilege escalation). The attacker has to wait for the dangling pointer to reference a data structure of the high assurance function to break into it.

Consequently, the occurrence of a fault in the low assurance component can lead an attacker to break through the high assurance one.