Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Summary
Security researchers have successfully executed their own code within a Windows VBS (Virtualization-based Security) enclave, a protected memory region designed to safeguard sensitive information. The specific enclave targeted by the researchers is responsible for handling passwords for Windows' anti-phishing feature, SmartScreen. This was achieved through the exploitation of a four-byte write and a timing bug.
IFF Assessment
The discovery of vulnerabilities that allow code execution within protected enclaves of an operating system is bad news for defenders, as it undermines the security guarantees of those enclaves.
Severity
This vulnerability allows for code execution within a highly sensitive enclave that protects anti-phishing data, suggesting a high attack vector (local, potentially exploitable remotely with other vulnerabilities) and significant impact on confidentiality and integrity, leading to an estimated CVSS score of 8.8.
Defender Context
This research highlights the ongoing challenges in securing protected enclaves within operating systems, even those designed for high security like VBS. Defenders should be aware that even seemingly robust security mechanisms can have subtle flaws, and vigilance in patching and monitoring for signs of exploit attempts is crucial. This could also spur further research into bypassing similar enclave technologies.