Kunal
03/20/2023, 4:50 AMC:\Program Files\osquery>osqueryi --disable-events=false --enable_process_etw_events=true
W0320 10:04:49.862340 9200 options.cpp:106] The CLI only flag --logger_plugin set via config file will be ignored, please use a flagfile or pass it to the process at startup
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> select * from shared_resources;
E0320 10:04:57.237459 9200 shared_resources.cpp:54] The following WMI query could not be constructed: SELECT * FROM Win32_Share. enum osquery::WmiError[0] (WmiRequest creation failed in ExecQuery)
Is this a bug ?
Thanks
KunalMarcos Oviedo
03/21/2023, 3:53 AMshared_resources
tables fails because of a bug in the WmiRequest::CreateWmiRequest
WMI helper. The shared_resources
table uses WMI to obtain the data, and WMI requests cannot be performed because of a bug in how WmiRequest::CreateWmiRequest
helper interacts with the COM framework.
The issue can be triggered if osqueryi
calls a table that uses COM before calling shared_resources
or any other WMI-based table.
So, for example, the query below will fail because of this same problem (`windows_update_history`uses COM)
osquery> select * from windows_update_history;
osquery> select * from shared_resources;
I've described the bug in detail in #7962. I've also pushed a fix for this bug in #7963.
@zwass @seph This bug exists before 5.8.0, but it can be indirectly triggered by using the ETW table. Can we consider adding the fix to a patch release in case there is one?seph
03/21/2023, 4:25 PMMarcos Oviedo
03/21/2023, 5:09 PM