Bios method to block compromised preboot features

1. An information handling system comprising:

at least one processor;

a memory coupled to the at least one processor; and

an information handling resource including a firmware;

wherein the information handling system is configured to:

boot an operating system stored on the memory;

after booting the operating system, receive, from at least one remote server, information regarding a vulnerability associated with the firmware;

create a firmware-specific feature flag based on the information regarding the vulnerability;

store the firmware-specific feature flag in a cryptographically signed policy table with identifying information for the information handling resource;

based on the cryptographically signed policy table, determine a resolution for mitigation of the vulnerability, wherein the resolution includes allowing the information handling resource to operate but disabling a particular feature of the information handling resource; and

store information regarding the resolution in a storage location accessible to a preboot environment of the information handling system, wherein the preboot environment is configured to apply the resolution upon a subsequent boot of the information handling system.

2. The information handling system of claim 1 , wherein the resolution includes preventing loading a driver associated with the information handling resource that includes the firmware.

3. The information handling system of claim 2 , wherein the driver is a Unified Extensible Firmware Interface (UEFI) driver.

4. The information handling system of claim 1 , wherein the preboot environment is a Basic Input/Output System of the information handling system.

5. The information handling system of claim 1 , wherein storing the information regarding the resolution in the storage location accessible to the preboot environment includes:

the operating system of the information handling system executing a persistent agent that has been presented to the operating system via a Windows Platform Binary Table (WPBT) channel; and

the persistent agent storing the information regarding the resolution in a designated storage space accessible to the preboot environment.

6. The information handling system of claim 1 , wherein the receiving, determining, and storing are carried out by a software agent executing on the operating system.

7. A method comprising:

booting an information handling system an operating system, wherein the information handling system comprises an information handling resource that includes a firmware;

after booting the operating system, the information handling system receiving, from at least one remote server, information regarding a vulnerability associated with the firmware;

creating a firmware-specific feature flag based on the information regarding the vulnerability;

storing the firmware-specific feature flag in a cryptographically signed policy table with identifying information for the information handling resource;

based on the cryptographically signed policy table, the information handling system determining a resolution for mitigation of the vulnerability, wherein the resolution includes allowing the information handling resource to operate but disabling a particular feature of the information handling resource; and

the information handling system storing information regarding the resolution in a storage location accessible to a preboot environment of the information handling system, wherein the preboot environment is configured to apply the resolution upon a subsequent boot of the information handling system.

8. The method of claim 7 , further comprising the information handling system requesting the information regarding the vulnerability.

9. The method of claim 7 , further comprising the information handling system receiving the information regarding the vulnerability without requesting such information.

10. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by a processor of an information handling system for:

booting an operating system;

after booting the operating system, receiving, from at least one remote server, information regarding a vulnerability associated with a firmware of an information handling resource of the information handling system;

creating a firmware-specific feature flag based on the information regarding the vulnerability;

storing the firmware-specific feature flag in a cryptographically signed policy table with identifying information for the information handling resource;

based on the cryptographically signed policy table, determining a resolution for mitigation of the vulnerability, wherein the resolution includes allowing the information handling resource to operate but disabling a particular feature of the information handling resource; and

storing information regarding the resolution in a storage location accessible to a preboot environment of the information handling system, wherein the preboot environment is configured to apply the resolution upon a subsequent boot of the information handling system.

11. The article of claim 10 , wherein the resolution includes preventing loading a driver associated with the information handling resource that includes the firmware.

12. The article of claim 11 , wherein the driver is a Unified Extensible Firmware Interface (UEFI) driver.

13. The article of claim 10 , wherein the preboot environment is a Basic Input/Output System of the information handling system.

14. The article of claim 10 , wherein storing the information regarding the resolution in the storage location accessible to the preboot environment includes:

the operating system of the information handling system executing a persistent agent that has been presented to the operating system via a Windows Platform Binary Table (WPBT) channel; and

the persistent agent storing the information regarding the resolution in a designated storage space accessible to the preboot environment.

15. The article of claim 10 , wherein the receiving, determining, and storing are carried out by a software agent executing on the operating system.