VNX-1320: Fault or watchdog alert signal suppressed

Field	Value
Rule ID	VNX-1320
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-1320
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	alert-suppression signals watchdog cwe-1320
Source	internal/sast/rules/vnx-1320.rego

Overview

VNX-1320 maps to CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals. CWE-1320 is a hardware weakness: an untrusted agent can disable or mask the alerts a component raises on a fault. The rule reports the nearest form visible in C and C++ source: code that switches off the channel the kernel and hardware use to report a fault, so the fault goes unnoticed and execution continues in an undefined state.

Reported:

• signal(), sigset(), bsd_signal() or sysv_signal() setting SIGSEGV, SIGBUS, SIGFPE, SIGILL, SIGSYS, SIGXCPU or SIGABRT to SIG_IGN;
• sigaction() installing one of those signals with a struct whose sa_handler was last set to SIG_IGN in the 15 lines above;
• ioctl(fd, WDIOC_SETOPTIONS, ...) with WDIOS_DISABLECARD on the line or in the 5 lines above;
• the watchdog magic close, write(fd, "V", 1), in a file that opens /dev/watchdog.

Not reported: ignoring SIGPIPE, SIGCHLD, SIGHUP, SIGINT and other non-fault signals, a real handler or SIG_DFL for a fault signal, ordinary ioctl calls (WDIOC_KEEPALIVE, WDIOC_SETTIMEOUT, terminal ioctls), comments and strings. The previous “any ioctl() call” heuristic was removed: an ioctl is not by itself an alert-protection issue.

What Gets Flagged

signal(SIGSEGV, SIG_IGN);        /* FLAGGED */

sa.sa_handler = SIG_IGN;
sigaction(SIGILL, &sa, NULL);    /* FLAGGED */

int flags = WDIOS_DISABLECARD;
ioctl(fd, WDIOC_SETOPTIONS, &flags);   /* FLAGGED */

What Is Not Flagged

signal(SIGPIPE, SIG_IGN);
sa.sa_handler = on_segv;          /* logs and exits */
sigaction(SIGSEGV, &sa, NULL);
ioctl(fd, WDIOC_KEEPALIVE, 0);

Remediation

1. Leave fault signals at their default action, or install a handler that records the fault and terminates with _exit().
2. Do not disarm a hardware watchdog from application code; keep the kernel’s nowayout option where the platform supports it.

References

• CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals
• Linux watchdog API

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1320
// nosec vnx-1320

Or record an ignore rule: vulnetix ignore add --rule vnx-1320 --reason "...". See Suppressing findings.