Fedora considers deprecating legacy BIOS [LWN.net]

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 3:40 UTC (Mon) by mjg59 (subscriber, #23239)
In reply to: Fedora considers deprecating legacy BIOS by wtarreau
Parent article: Fedora considers deprecating legacy BIOS

The security situation around BIOS was *much* worse than on UEFI, it's just that the general platform security situation was sufficiently bad that nobody was really looking at it.

to post comments

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 14:09 UTC (Mon) by khim (subscriber, #9252) [Link] (6 responses)

I think you should separate the XX century from the XXI century here.

I still remember MS-6309.

Year 2000 edition had a nice, simple jumper which made ROM read-only. Yes, certain change in configuration cause complaints at boot, but it was a simple matter of changing its position for one boot and return it back after that.

It was as protected from malware as one can imagine.

And then version 5 from 2001 (or was it 2002?) which not only lacked jumper in that place, it refused to boot if you short these two numbs which were left in it's place!

So, please don't tell about the problematic situation with BIOS. It wasn't problematic when people cared. It is, of course, became problematic when people started thinking only about flexibility and forgot that it's not a good idea to have computers which are trivially bricked.

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 14:26 UTC (Mon) by pizza (subscriber, #46) [Link] (4 responses)

> I still remember MS-6309.
>Year 2000 edition had a nice, simple jumper which made ROM read-only. Yes, certain change in configuration cause complaints at boot, but it was a simple matter of changing its position for one boot and return it back after that.

Meanwhile, the other 99.999% of motherboards lacked that feature, including, as you mentioned, later versions of that same motherboard. One data point does not a generalization make.

BIOS is layered-hacks-on-top-of-layered-hacks built that goes all the way back to 1982. [1] It's long past time to shoot it in the head. And it's also why, to this day, our bleeding edge Ryzen processors still pretend to be a 44-year-old 16-bit i8086 when powering up.

[1] As in when Compaq released PC clones using a clean-room reverse-engineered BIOS.

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 15:14 UTC (Mon) by khim (subscriber, #9252) [Link] (3 responses)

> Meanwhile, the other 99.999% of motherboards lacked that feature, including, as you mentioned, later versions of that same motherboard. One data point does not a generalization make.

Sorry, but no. It's most definitely not 99.999%. I know for the fact that you had to replace ROM chips on Risc PC, Amiga (in fact you can still buy a replacement chips) and I have seen "Flash Protect" switch on lots and lots of motherboards made in XX centory.

I remember that one specifically because it was a surprise to me that they would remove it.

> BIOS is layered-hacks-on-top-of-layered-hacks built that goes all the way back to 1982.

Yes, so what? It works. It's secure (more secure than the XXI century abomination). And easy to provide in virtual environment.

EFI is huge mess with the only redeeming quality: it can support >4TB SSDs. That's great, but I'm not sure all that pointless complexity is worth it.

Insecure-by-design POS which can not be protected by design — and I'm supposed to use for sake of “security”? Puhlease.

Sure, I use EFI when I have no choice, but that doesn't mean it's not POS.

> And it's also why, to this day, our bleeding edge Ryzen processors still pretend to be a 44-year-old 16-bit i8086 when powering up.

So what? One doesn't need that many transistors to implement that more and today there are billions of them on any x86 CPU.

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 15:41 UTC (Mon) by farnz (subscriber, #17727) [Link] (1 responses)

Note, though, that on all modern x86 hardware platforms, "traditional" BIOS is implemented as a module running atop UEFI; so you get all the vulnerabilities of UEFI, plus extra holes due to the CSM that implements the BIOS interface.

Which, in turn, makes the claims about BIOS being more secure questionable - you're talking about an additional layer atop UEFI, which can have its own vulnerabilities, plus you have the full stack of UEFI beneath it to compromise.

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 15:46 UTC (Mon) by khim (subscriber, #9252) [Link]

That's very true, sure. I see no reason to use the BIOS interface on the system where it's emulated via CSM.

But I don't think it's imlemented that way in virtual systems and other small systems where Linux can still run.

Although I wonder how many of these are out there which may not just run Linux, but specifically Fedora. It's pretty heavy novadays.

Fedora considers deprecating legacy BIOS

Posted Apr 29, 2022 15:48 UTC (Fri) by ms-tg (subscriber, #89231) [Link]

@corbet Any thoughts on the level and style of discourse on these BIOS and UEFI threads? Doesn't seem in keeping with LWN, wondering if you had any thoughts.

Fedora considers deprecating legacy BIOS

Posted Apr 25, 2022 18:24 UTC (Mon) by wtarreau (subscriber, #51152) [Link]

> Year 2000 edition had a nice, simple jumper which made ROM read-only

Many of us have had much more robust than a jumper, an EPROM that required UV light to erase them, and a special programmer delivering 21V to the VPP pin to program them :-) There was no need for a jumper, and as an added bonus, not being upgradable in field tended to make them less bogus (at least they were more tested than my core i7's AMI BIOS).

Fedora considers deprecating legacy BIOS

Posted Apr 28, 2022 12:55 UTC (Thu) by stock (guest, #5849) [Link] (2 responses)

I think you need to back that up. Here's a recent example to the
contrary :
https://www.theregister.com/2022/04/27/microsoft-linux-vu...
which is vulnerability within systemd and only happens on UEFI hardware.

Fedora considers deprecating legacy BIOS

Posted Apr 28, 2022 13:47 UTC (Thu) by pizza (subscriber, #46) [Link]

> which is vulnerability within systemd and only happens on UEFI hardware.

The vulnerability is actually with networkd-dispatcher, which is developed (and distributed!) independently from systemd. It's not even widely packaged in distributions! It's not a "systemd vulnerability" any more than a vulnerability in NetworkManager or Apache (or any other random daemon) can be called a "systemd vulnerability."

Meanwhile I see nothing in the article about how this vulnerability can only affect UEFI systems -- it seems to involve relatively run-of-the-mill symlink traversal, and the CVE descriptions are still redacted. Can you point us towards some sort of supporting evidence for your assertion?

Fedora considers deprecating legacy BIOS

Posted Apr 28, 2022 21:09 UTC (Thu) by johannbg (guest, #65743) [Link]

> https://www.theregister.com/2022/04/27/microsoft-linux-vu...
which is vulnerability within systemd and only happens on UEFI hardware.

Interesting even Keith Richards drugs aren't strong enough to reach that conclusion in otherwords please explain to the audience here on LWN how a security flaw in networkd-dispatcher has anything to do with systemd and it only be happening on uefi hardware.

I eagerly await your response on the matter backing that up...