Reports from credible cybersecurity firms or news outlets

New Windows 11 Driver Signature Bypass Enables Kernel Rootkit Installs and VAC Kernel-Mode Bypass

Oct 26, 2024, 03:34 PM

Recent reports indicate a significant security vulnerability in Windows systems, specifically a new bypass of the Windows Driver Signature enforcement that allows for the installation of kernel rootkits. This development has raised concerns regarding the potential for local users to gain elevated privileges on Windows 11 due to a vulnerability in the Common Log File System (CLFS) driver. Additionally, there are reports of a fully functional VAC kernel-mode bypass that utilizes either SSDT hooks or Infinityhook to intercept VAC syscalls, effectively spoofing results to bypass memory integrity checks. The implications of these vulnerabilities could pose serious risks to system security and user data integrity.