On Tue, May 09, 2017 at 04:16:39PM -0700, Darren Hart wrote: > To address this, I have proposed [3] that exporting WMI be opt-in, only done at > the request of and in collaboration with a vendor, with the kernel platform > driver given the opportunity to filter requests. This filtering would need to be > at the method and argument inspection level, such as checking for specific bits > in the input buffer, and rejecting the request if they conflict with an in > kernel usage (that's worst case, in some cases just GUID or method ID could be > sufficient). WMI calls generally end up triggering system management mode, and SMM is a mess of insecure code. People have been putting extensive effort into avoiding mechanisms that allow root to escalate to higher privilege levels - this is almost certainly the opposite of that. If the filtering is sufficient to guarantee that no invalid input will ever hit the firmware then that's not a problem, but that doesn't seem meaningfully less complicated than just writing a proper driver in the first place. As things stand, I think this is functionality that would have to be disabled by the lockdown patchset, which means that it's functionality that wouldn't exist for the majority of non-server platforms (and an increasing number of server platforms). -- Matthew Garrett | mjg59@xxxxxxxxxxxxx
