3 ms·
Technically, denial of service is a security issue - I have modern servers that boot via UEFI (since GPT is required to support large disks), hopefully with les
by snuxoll 11y ago
Technically, denial of service is a security issue - I have modern servers that boot via UEFI (since GPT is required to support large disks), hopefully with less buggy implementations but if someone manages to get root on a server they could totally kill the hardware.
Having to reinstall an OS because some script kiddie decided to `rm -rf --no-preserve-root /` your server bites, but actually bricking the system requiring a board replacement is scary. (Of course, they could technically be a jerk and flash your UEFI EEPROM, but most servers have a backup they will restore from in case the primary has been corrupted).
EDIT: Though, now that I think about it, this is still only going to stop users from hosing their systems. A malicious user could still run an arbitrary binary or kernel module that hoses the UEFI variables as well. Or by modifying the UEFI boot config to load some other custom UEFI binary to hose it... firmware vendors really just need to get their crap in gear, software (even running in UEFI boot services mode shouldn't be able to hose it).
- mikeash 11y agoRegarding your edit, exactly. The issue could be considered a security issue, but this fix is not a security fix. A security fix would be something like only allowing touching EFI during startup and then somehow securely and permanently disabling that ability until the next reboot, or a physical write-protect switch on the computer. Or EFI firmware not being so stupid, but we know that's not going to happen.
- snuxoll 11y agoMaybe if there was some awful Windows virus that nuked boards with bad implementations they would fix their crap.
- yrro 11y agoBingo. You're only a call to SetFirmwareEnvironmentVariable away from having your Windows system hosed.
- yuhong 11y agoMore precisely, every EFI firmware not being so stupid. BTW, you will see that a "high quality UEFI BIOS" is part of my wishlist for an Intel/AMD branded laptop: https://www.reddit.com/r/hardware/comments/42cnbq/would_intelamd_branded_laptops_be_a_good_idea/ https://www.reddit.com/r/hardware/comments/42cnbq/would_inte...