Privilege Escalation on Windows 8/UEFI Systems | Hacker News Reader

Privilege Escalation on Windows 8/UEFI Systems

mitre.org

55 pointschopin10 comments

"privileged userland process" is a circular way of saying administrator. They claim administrator is "ring 3" or "admin ring 3" which is super-confusing...

Essentially what this is is a way of installing malware into the kernel bypassing the driver signing requirements. You need admin access already.

It might be useful, but they're clearly trying to make it appear more significant than it is by their technically inaccurate word choices.

I think if you are the admin/root you own the machine anyway, so there's really no vulnerability here.

Essentially what this is is a way of installing malware into the kernel bypassing the driver signing requirements.

It's funny that being able to load unsigned drivers and/or access hardware directly from userspace in Linux when you are root is not considered a vulnerability, whereas on Windows it is... and it agrees with my hypothesis that proprietary operating systems are moving towards a model of "execution of any code that isn't approved by Microsoft/Apple/Google/$some_corporate_entity is a vulnerability."

Loading unsigned drivers and/or accessing hardware directly from userspace in Linux when you are root and have booted with UEFI "Secure Boot" enabled is considered a vulnerability. If it weren't, Microsoft would not sign the shim Linux distributions use.

> "privileged userland process" is a circular way of saying administrator. They claim administrator is "ring 3" or "admin ring 3" which is super-confusing...

It doesn't seem a circular description but the full technical one, at least from a processor privilege point of view.

And I find it pretty amazing, they are invalidating the whole purpose of the UEFI without needing to execute ring0 code.

IIRC windows only has two permission levels anyway, user and admin.

Actually, there are many integrity levels for user's processes in Windows: untrusted, low, medium, high and system. (http://msdn.microsoft.com/en-us/library/bb625963.aspx)

To quote Wikipedia[0] ("Architecture of Windows NT"):

> While the x86 architecture supports four different privilege levels (numbered 0 to 3), only the two extreme privilege levels are used. Usermode programs are run with CPL 3, and the kernel runs with CPL 0. These two levels are often referred to as "ring 3" and "ring 0", respectively. Such a design decision had been done to achieve code portability to RISC platforms that only support two privilege levels, though this breaks compatibility with OS/2 applications that contain I/O privilege segments that attempt to directly access hardware.

[0] https://en.wikipedia.org/wiki/Architecture_of_Windows_NT#Ker...

Except MS has implemented software-based permission groups, which the person you're replying to pointed out. This really low level x86 stuff doesn't mean you can't have more granularity.

Windows has system, high, medium, low, and untrusted security levels that get mapped to security groups. A local admin is high, but not system, etc.

Indeed, but it isn't a "ring." A protection ring has a specific meaning and that meaning IS about "low level [CPU] stuff." For example the CPU can be made to support more than two rings, Windows NT and UNIX just only utilise two of them and then build software protections on top (OS/2 supported 3).

https://en.wikipedia.org/wiki/Protection_ring

"Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its privileges from ring 3 all the way up to that of the platform firmware, which attains permanent control of the very-powerful System Management Mode."

That's the part to get worried about right there - fiddling with SMM is Serious Business. For instance, it's the sort of place NSA hides rootkits:

http://en.wikipedia.org/wiki/System_Management_Mode#Problems

Reply on news.ycombinator.com