CWE-1338 covers hardware that is missing or has inadequate features to prevent overheating. It affects device makers, and operators of ICS and OT equipment.
How it happens
Circuits dissipate part of the energy they consume as heat. In semiconductors, a higher operating frequency means more power dissipation and more heat. MITRE explains that leakage current in CMOS circuits rises with temperature, creating positive feedback that can lead to thermal runaway and permanent damage.
A device without thermal sensors, adequate cooling or thermal insulation can be attacked by malicious software that deliberately runs it in modes that overheat. That works as a denial of service, or a permanent denial of service. Depending on the device, overheating can also cause safety hazards and reliability issues.
MITRE notes that battery failures can also overheat a device, but the mitigations here cannot reliably protect against them. Overvoltage and overcurrent have similar weaknesses, but this one is about heat from hardware operation.
What an attacker gains
Availability, through resource consumption rated high impact.
How to find it
Both methods in the record are rated high. Run dynamic tests that stress the temperature controls and interpret the results manually. Include power management controls in architecture and design reviews.
How to fix it
- Enforce temperature maximum and minimum limits using thermal sensors in silicon and at the platform level.
- Support cooling that can be modulated, such as fans, based on device operation needs, to keep the temperature stable.
Quick check
Why is overheating a security problem and not only a reliability one?
Malicious software can deliberately drive the device into overheating modes, producing a denial of service or a permanent one.
