SafeBreach safety researcher Alon Leviev has launched his Home windows Downdate software, which can be utilized for downgrade assaults that reintroduce previous vulnerabilities in up-to-date Home windows 10, Home windows 11, and Home windows Server programs.
In such assaults, menace actors pressure up-to-date focused gadgets to revert to older software program variations, thus reintroducing safety vulnerabilities that may be exploited to compromise the system.
Home windows Downdate is accessible as an open-source Python-based program and a pre-compiled Home windows executable that may assist downgrade Home windows 10, Home windows 11, and Home windows Server system parts.
Leviev has additionally shared a number of utilization examples that permit downgrading the Hyper-V hypervisor (to a two-year-old model), Home windows Kernel, the NTFS driver, and the Filter Supervisor driver (to their base variations), and different Home windows parts and beforehand utilized safety patches.
“You can use it to take over Windows Updates to downgrade and expose past vulnerabilities sourced in DLLs, drivers, the NT kernel, the Secure Kernel, the Hypervisor, IUM trustlets and more,” SafeBreach safety researcher Alon Leviev defined.
“Other than custom downgrades, Windows Downdate provides easy to use usage examples of reverting patches for CVE-2021-27090, CVE-2022-34709, CVE-2023-21768 and PPLFault, as well as examples for downgrading the hypervisor, the kernel, and bypassing VBS’s UEFI locks.”
As Leviev mentioned at Black Hat 2024 when he disclosed the Home windows Downdate downgrade assault—which exploits the CVE-2024-21302 and CVE-2024-38202 vulnerabilities—utilizing this software is undetectable as a result of it can’t be blocked by endpoint detection and response (EDR) options and Home windows Replace retains reporting that the focused system is up-to-date (regardless of being downgraded).
“I discovered multiple ways to disable Windows virtualization-based security (VBS), including its features such as Credential Guard and Hypervisor-Protected Code integrity (HVCI), even when enforced with UEFI locks. To my knowledge, this is the first time VBS’s UEFI locks have been bypassed without physical access,” Leviev mentioned.
“As a result, I was able to make a fully patched Windows machine susceptible to thousands of past vulnerabilities, turning fixed vulnerabilities into zero-days and making the term “absolutely patched” meaningless on any Windows machine in the world.”
Whereas Microsoft launched a safety replace (KB5041773) to repair the CVE-2024-21302 Home windows Safe Kernel Mode privilege escalation flaw on August 7, the corporate has but to offer a patch for CVE-2024-38202, a Home windows Replace Stack elevation of privilege vulnerability.
Till a safety replace is launched, Redmond advises prospects to implement suggestions shared within the safety advisory revealed earlier this month to assist shield in opposition to Home windows Downdate downgrade assaults.
Mitigation measures for this subject embody configuring “Audit Object Access” settings to watch file entry makes an attempt, limiting replace and restore operations, utilizing Entry Management Lists to restrict file entry, and auditing privileges to determine makes an attempt to use this vulnerability.
