Attacking a hardware AES implementation if it leaks the intermediate round states
If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys.
Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible.

Take for example round 1:
you get the internal state before AddRoundKey (of round 2), you get back at the beginning of round 1, and you get the plaintext XORed with the first round key.

Finally, recovering all round keys is equivalent to recover the master key.