Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
PLUS: NSA shares cloud security tips; Infosec training for Jordanian women; Critical vulnerabilities
You're viewing a single thread.
It they've already got admin privileges, you're already fucked.
Other OSes like Linux try to maintain this security boundary, though: https://www.man7.org/linux/man-pages/man7/kernel_lockdown.7.html
Permanently Deleted
You might be right. I think that the Linux kernel doesn't have an ABI though, so I believe the driver has to be built for the current version of the kernel. I think the idea is also that the driver is signed by the distro, not Microsoft, so the risk of random drivers getting signed accidentally is probably much lower.
depends, they can also loaded via dkms which may not require it
DKMS taints the kernel in most setups and also requires secure boot in most contexts, disabling lock down mode and disabling most protections in the first place. If you use DKMS (to use the Nvidia driver, for example), the security boundary between root and kernel is basically nonexistent.
I'd love to see distros guide users to setting up secure boot properly (with custom certificates so Linux can be booted securely) but in practice most distros don't have this protection boundary.
It kinda depends, on custom kernels DKMS can be incredibly helpful. Like for a hardened kernel, a lot of drivers may be loaded via DKMS.
Yeah, it actually looks like Ubuntu leaves the module signing key accessible to root on the filesystem:
https://wiki.ubuntu.com/UEFI/SecureBoot#Security_implications_in_Machine-Owner_Key_management
So root access basically gives you kernel access, if you just sign a malicious kernel module with the MOK.
That's just a criticism of the Windows kernel.