• Researchers have identified a vulnerability in the Windows kernel.
• Vulnerability lets attackers bypass security to rollback OS components.

A newly discovered attack technique could enable malicious actors to bypass Microsoft’s Driver Signature Enforcement (DSE) on fully patched Windows systems. The vulnerability opens the door to an operating system (OS) downgrade attack, allowing attackers to revert critical OS components to outdated, less secure versions.

SafeBreach researcher Alon Leviev reported on the bypass, which he shared with The Hacker News, noting that it facilitates the loading of unsigned kernel drivers. “This bypass enables attackers to install custom rootkits that can neutralise security controls, hide processes and network activity, maintain stealth, and much more,” Leviev explained.

The research builds on previous findings of two privilege escalation problems in the Windows update process (CVE-2024-21302 and CVE-2024-38202). Threat actors can use these vulnerabilities to exploit the Windows update mechanism, triggering a rollback to older, more vulnerable operating system versions.

According to Leviev, the attack was carried out through a tool called “Windows Downdate.” The technique, he explained, enables adversaries to hijack the Windows Update process and execute fully undetectable, persistent, and irreversible downgrades on critical OS components.

The ability to deploy undetectable downgrades poses a serious threat since it offers a more adaptable alternative to traditional Bring Your Own Vulnerable Driver (BYOVD) attacks. While BYOVD attacks allow threat actors to load vulnerable drivers to gain unauthorised kernel-level access, the Windows Downdate method goes a step further, downgrading key first-party modules, including the OS kernel itself.

In response, Microsoft addressed CVE-2024-21302 and CVE-2024-38202 in its Patch Tuesday releases on August 13 and October 8, 2024. The updates aimed to prevent the rollback vulnerability exploited by the Windows Downdate tool.

However, Leviev’s findings reveal that even with these patches, a skilled use of the Windows Downdate tool can still bypass DSE on fully-updated Windows 11 systems. Leviev’s approach specifically enables attackers to undo Microsoft’s “ItsNotASecurityBoundary” DSE bypass patch, a security feature designed to prevent such vulnerabilities.

Gabriel Landau of Elastic Security Labs documented the “ItsNotASecurityBoundary” bypass in July 2024. It involves a race condition that allows a verified security catalogue file to be replaced with a malicious version signed for an unsigned kernel driver. When the kernel is prompted, it loads the altered driver, granting the attacker kernel-level code execution.

The exploit achieves DSE bypass by using the downgrade tool to replace the “ci.dll” library with an unpatched version (10.0.22621.1376), effectively reversing Microsoft’s security update.

However, a countermeasure does exist: if Virtualisation-Based Security (VBS) is enabled on the target system, catalog scanning is conducted by the Secure Kernel Code Integrity DLL (skci.dll) instead of ci.dll. Yet, due to the default VBS configuration being unlocked by UEFI, an attacker could disable it by modifying the EnableVirtualizationBasedSecurity and RequirePlatformSecurityFeatures registry keys.

Even in cases where the UEFI lock is present, attackers may still disable VBS by corrupting core files, thus compromising VBS functionality. To successfully carry out the DSE bypass attack, attackers generally follow these steps:

1. Disable VBS in the Windows Registry or invalidate SecureKernel.exe.
2. Downgrade ci.dll to an unpatched version.
3. Restart the machine to apply changes.
4. Exploit the “ItsNotASecurityBoundary” bypass to execute kernel-level code.

The only scenario that thwarts this approach is when VBS is enabled with both a UEFI lock and a “Mandatory” flag, which, as Microsoft’s documentation states, prevents the OS loader from proceeding if critical virtualisation files fail to load. The mode is activated manually via a registry setting.

To fully mitigate this attack, VBS must be activated with both the UEFI lock and the Mandatory flag. Without these configurations, attackers could disable VBS, perform a DLL downgrade, and successfully bypass DSE.

Leviev emphasises that to effectively combat such attacks, security measures should seek to detect and block component downgrades — even those that occur outside of traditionally-defined security boundaries.

Looking to revamp your digital transformation strategy? Learn more about Digital Transformation Week taking place in Amsterdam, California, and London. The comprehensive event is co-located with AI & Big Data Expo, Cyber Security & Cloud Expo, and other leading events.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.