MemoryRanger Prevents Hijacking FILE_OBJECT Structures in Windows Kernel
This addresses a security problem for Windows users by preventing privilege escalation and data tampering, though it is incremental as it builds on existing hypervisor-based isolation techniques.
The paper tackles the vulnerability of Windows 10 kernel memory to attacks that hijack FILE_OBJECT structures for unauthorized file access, and demonstrates that MemoryRanger, a hypervisor-based solution, can prevent this by isolating kernel-mode drivers in memory enclaves.
Windows OS kernel memory is one of the main targets of cyber-attacks. By launching such attacks, hackers are succeeding in process privilege escalation and tampering with users data by accessing kernel mode memory. This paper considers a new example of such an attack, which results in access to the files opened in an exclusive mode. Windows built-in security features prevent such legal access, but attackers can circumvent them by patching dynamically allocated objects. The research shows that the Windows 10, version 1809 x64 is vulnerable to this attack. The paper provides an example of using MemoryRanger, a hypervisor-based solution to prevent such attack by running kernel-mode drivers in isolated kernel memory enclaves.