2

Does arbitrary kernel read write from usermode count as a vulnerability if it requires admin or is it fine since it requires admin?

1 Answer 1

3

Generally this would not be considered a vulnerability, no.

You aren't giving details, so I cannot speak for your specific case. You don't even mention the operating system [1].

Why? A hypothetical scenario on Windows

But let's assume Windows 10/11 for a second. The BUILTIN\Administrators alias and also the built-in Administrator principal (RID == 500) has certain powers that provide pathways into the TCB. One such way would be a service. While still being user mode (UM), it allows an administrator to execute code as NT AUTHORITY\SYSTEM (aka "LocalSystem") or NT SERVICE\TrustedInstaller. Enabling all privileges in that user context will bestow a lot of power already. But we can take it one further. The service control manager (SCM) isn't just responsible for UM services, but also for kernel mode (KM) drivers, with the exception of PnP drivers. So, an administrator could install a driver (perhaps after enabling test signing via bcdedit) and then simply read/write kernel memory at will by talking to that driver (ReadFile/WriteFile or DeviceIoControl).

So as you can see an administrator has already the privileges necessary to run code that can read/write kernel memory.

That's why it would not be considered a vulnerability.


... however

Suppose that little precondition with already being an administrator didn't exist. Something, such as a vulnerable driver, would allow an unprivileged user to read/write kernel memory. That would be a vulnerability for sure and you could report the responsible kernel mode driver here.


[1] Consider modern Linux. If whatever you found would allow a rootless container (think Podman) to read/write kernel memory of the hosting kernel, that'd be a huge issue and most certainly be considered a vulnerability. Back on Windows if an app container or code in a silo could read/write kernel memory that would be comparable (these entities generally have less privileges than any administrator on the system hosting the container/silo).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.