Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Integrity Protection Driver文件保护可被符号链接绕过漏洞
Vulnerability Description
Pedestal Software的完整性保护驱动(IPD)是一款开放源代码设备驱动，设计用于禁止新服务和驱动安装，防止已经存在的驱动被篡改。 Pedestal Software IPD对符号链接处理不正确，本地攻击者可以利用这个漏洞绕过保护，使用恶意文件覆盖驱动文件。 为了防止恶意模块装载到内核中，IPD对winnt/system32/drivers目录进行保护，因此不能修改此目录中的任意文件，这通过使用ZwCreatFile()和ZwOpenFile()函数完成，并使用字符串对比检查文件路径。 但是，
CVSS Information
N/A
Vulnerability Type
N/A