  Hardware and software of secured embedded systems are prone to physical
attacks. In particular, fault injection attacks revealed vulnerabilities on the
data and the control flow allowing an attacker to break cryptographic or
secured algorithms implementations. While many research studies concentrated on
successful attacks on the data flow, only a few targets the instruction flow.
In this paper, we focus on electromagnetic fault injection (EMFI) on the
control flow, especially on the instruction cache. We target the very
widespread (smartphones, tablets, settop-boxes, health-industry monitors and
sensors, etc.) ARMv7-M architecture. We describe a practical EMFI platform and
present a methodology providing high control level and high reproducibility
over fault injections. Indeed, we observe that a precise fault model occurs in
up to 96% of the cases. We then characterize and exhibit this practical fault
model on the cache that is not yet considered in the literature. We
comprehensively describe its effects and show how it can be used to reproduce
well known fault attacks. Finally, we describe how it can benefits attackers to
mount new powerful attacks or simplify existing ones.
