62
Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
(www.theregister.com)
this post was submitted on 12 Mar 2024
62 points (93.1% liked)
cybersecurity
3155 readers
1 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It they've already got admin privileges, you're already fucked.
Other OSes like Linux try to maintain this security boundary, though: https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.html
You might be right. I think that the Linux kernel doesn't have an ABI though, so I believe the driver has to be built for the current version of the kernel. I think the idea is also that the driver is signed by the distro, not Microsoft, so the risk of random drivers getting signed accidentally is probably much lower.
depends, they can also loaded via dkms which may not require it
It kinda depends, on custom kernels DKMS can be incredibly helpful. Like for a hardened kernel, a lot of drivers may be loaded via DKMS.
Yeah, it actually looks like Ubuntu leaves the module signing key accessible to root on the filesystem:
https://wiki.ubuntu.com/UEFI/SecureBoot#Security_implications_in_Machine-Owner_Key_management
So root access basically gives you kernel access, if you just sign a malicious kernel module with the MOK.
That's just a criticism of the Windows kernel.