AI risk level

Medium

Recommendation

review

Model

~deepseek/deepseek-v4-flash-latest

Analyzed commit

b2d350b

Reviewed

1 month ago

This is a legitimate-looking hardware utility that installs a root systemd service to read MSI EC telemetry and toggle Cooler Boost. The deterministic scan's 'high' findings are expected consequences of the plugin's stated purpose (installing a systemd unit and enabling it at boot), not evidence of malicious behavior. However, the code has real security weaknesses: the Unix socket has no authentication or CSRF-style protection, the helper runs as root and can write to EC registers, and the install script has a minor path-injection issue, so a human should review before publishing.

• • The root service exposes an unauthenticated Unix socket at /run/msi-gp66-fan-control.sock. Any local user can connect and toggle Cooler Boost, which is a denial-of-service / hardware-abuse vector on a laptop.
• • The helper runs as root and writes to EC registers (0xF4, 0x98) with only a board-name check. A bug in the EC write path or a malicious local user could potentially corrupt EC state, though the code does validate board and register addresses.
• • install.sh uses `install -o "$install_uid" -g "$install_gid"` where install_uid/install_gid come from SUDO_UID/SUDO_GID. If SUDO_UID is set but SUDO_GID is not, install_gid will be empty, causing install to fail or misbehave. This is a robustness issue, not a security hole.
• • The service file runs `modprobe ec_sys write_support=0` at boot, which is expected for this hardware, but it means the EC is accessible via debugfs. The helper does not verify the integrity of the EC snapshot, so a malicious EC could return arbitrary data, but this is a low-risk concern.
• • The socket accepts any JSON with a 'command' field and only whitelists 'status' and 'cooler-boost', which is good. However, the 'cooler-boost' command does not validate the value type beyond 'on'/'off', and the helper's run() function accepts 'set-mode' and other commands via the CLI, but the socket only exposes the two whitelisted commands. This is acceptable but worth noting.
• • The install script copies BarWidget.qml and manifest.json to the user's config directory, but it does not copy the Python helper/client to the plugin directory; it installs them to /usr/local/libexec. This is fine, but the uninstaller removes the entire plugin directory with `rm -rf "$plugin_dir"`, which could delete user data if the path is ever misconfigured. The path is derived from the user's home, so it's low risk.

AI advisory only — automated analysis, not a security guarantee.