OS Demote Vulnerability Discovered in Microsoft Windows Kernel

SafeBreach researcher Alon Leviev highlighted that this vulnerability allows the loading of unsigned kernel drivers, which could enable attackers to deploy custom rootkits. These rootkits can neutralize security controls, conceal processes and network activities, and maintain a stealthy presence on the compromised system. The implications of this vulnerability are profound, as it offers a new method for attackers to exploit.

.These flaws could be weaponized to roll back updated Windows software to older versions that contain unpatched security vulnerabilities.

The Windows Downdate Tool

The exploit is facilitated by a tool known as Windows Downdate, which can hijack the Windows Update process. According to Leviev, this tool allows attackers to create undetectable, persistent, and irreversible downgrades of critical OS components. This capability poses a severe threat, as it provides a more effective alternative to Bring Your Own Vulnerable Driver (BYOVD) attacks, enabling the downgrading of first-party modules, including the OS kernel itself.

Exploitation Mechanism

The “ItsNotASecurityBoundary” DSE bypass was first documented by Elastic Security Labs researcher Gabriel Landau in July 2024. which exploits a race condition to change an verified security catalog object with a malicious version that contains an authenticode signature for an unsigned kernel driver, Microsoft’s code integrity mechanism, which uses the kernel mode library ci.dll for file authentication, can fall victim to this exploit. The downgrade tool effectively replaces the ci.dll library with an older version, thereby undoing the security patch implemented by Microsoft.

Mitigation Strategies

While there is a security barrier in place that can prevent this bypass from succeeding, it relies on Virtualization-Based Security (VBS) being active on the targeted host. However, the default VBS configuration often lacks a Unified Extensible Firmware Interface (UEFI) lock, allowing attackers to disable it by manipulating registry keys.

To This configuration ensures that the system will not boot if any of the virtualization modules fail to load, thereby providing an additional layer of security.

Conclusion

The discovery of this OS downgrade vulnerability underscores the need for robust security measures in operating systems. As Leviev noted, security solutions should focus on detecting and preventing downgrade procedures, even for components that do not cross defined security boundaries.

In response to these findings, Microsoft is actively developing a security update aimed at revoking outdated, unpatched VBS system files to mitigate this threat. The company emphasizes the importance of rigorous testing to ensure customer protection while minimizing operational disruptions.

By staying informed about such vulnerabilities and implementing recommended security practices, users can better safeguard their systems against potential attacks.