CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
How it's found
Improper Protection for Outbound Error Messages and Alert Signals is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Hardware sensors are used to detect whether a device is operating within design limits. The threshold values for these limits are set by hardware fuses or trusted software such as a BIOS. Modification of these limits may be protected by hardware mechanisms. When device sensors detect out of bound conditions, alert signals may be generated for remedial action, which may take the form of device shutdown or throttling. Warning signals that are not properly secured may be disabled or used to generate spurious alerts, causing degraded performance or denial-of-service (DoS). These alerts may be masked by untrusted software. Examples of these alerts involve thermal and power sensor alerts.
Vulnerable vs. safe
The processor-GPIO controller exposes software-programmable controls that allow untrusted software to reprogram the state of the GPIO pin.The GPIO alert-signal pin is blocked from untrusted software access and is controlled only by trusted software, such as the System BIOS.Consequences
- DoS: Instability, DoS: Crash, Exit, or Restart, Reduce Reliability, Unexpected State
Mitigations
- Architecture and Design: Alert signals generated by critical events should be protected from access by untrusted agents. Only hardware or trusted firmware modules should be able to alter the alert configuration.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-1320?
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
How do you find Improper Protection for Outbound Error Messages and Alert Signals?
Improper Protection for Outbound Error Messages and Alert Signals is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1320?
DoS: Instability, DoS: Crash, Exit, or Restart, Reduce Reliability, Unexpected State
Does TurboPentest test for Improper Protection for Outbound Error Messages and Alert Signals?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest