The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
sc.exe create atlAccesssys binPath= C:\windows\temp\atlAccesssys.sys type=kernel && sc.exe start atlAccesssyssc.exe create atlAccesssys binPath= C:\windows\temp\atlAccesssys.sys type=kernel && sc.exe start atlAccesssysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068