Re: Do not allow MSR or Embedded Controller writes from userspace in secure boot case

[Matthew Garrett <mjg59-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>]

On Thu, Nov 08, 2012 at 10:40:33AM +0100, Thomas Renninger wrote:
> On Wednesday, November 07, 2012 09:54:03 PM Matthew Garrett wrote:
> > Is there a case where modifying MSRs or EC registers can cause arbitrary
> > code execution?
> 
> Ok, I am not familiar enough with this secure stuff.
> Theoretically writing EC registers could be used to trick ACPI
> code and change the way it is processed by inspecting ACPI
> code for bad EC register return values.

I'd prefer to see an actual example before worrying too much about this.

> Similar for MSR, the kernel could be (not directly) influenced
> by setting MSR registers in a way it does not expect them to be.

Again, I'd like to see an example of arbitrary code execution.

> I expect it's easy to get the system totally stalled/hang/rebooted
> with bad MSR writes which I thought should be forbidden for
> userspace (even for root...) in secure boot mode.

root can call halt, which is a trivial DoS. It's not worth worrying 
about people wedging the system.

-- 
Matthew Garrett | mjg59-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org