> Doesn’t seem worth the read. Nothing new here. Of course call-gates allow ring0 access from ring3 if
> setup properly, and of course a driver with a bug allows you to muck around in kernel space.

To be honest, I think that pretty much every ring-0 exploitation technique is obvious from a specific point of view. However, does it mean that no methods regarding this subject should either be described in papers or generally mentioned anywhere, just because of their “obviousness”? As written in the abstract, there’s really no revolutionary information included – the point is to make the coders reconsider their w-w-w exploitation targets or maybe just cause some interesting discussion to arise.

Moreover, our paper covers “extreme” situations, where the attacker is able to overwrite only 1 byte of the protected memory; the PoC code aims to prove that it is still possible to perform a stable priv. escal. attack with just this.

> I will give credit for putting together those two things with a process only LDT to create call-gates. Nicely
> done, but still, all you need to do is read the Intel manuals to know this is possible.

Again, you’re right up to a point. We can observe the very same situation when it comes to VM detection methods; once more, everything one needs to do is to read the Intel (or any other processor’s) manuals and perform his own tests. No secret knowledge here, but still a number of blog entries / articles / other publications are commited, covering this subject. Why? because it is interesting!

> The title is very misleading, this has nothing to do with Windows itself being vulnerable.

Well, does the title really state that Windows is vulnerable, in any point? As far as I am concerned, the “Windows kernel vulnerability exploitation” phrase makes it clear that the paper is about general ring-0 exploitation techniques… not about any Windows vulnerability.

I will give credit for putting together those two things with a process only LDT to create call-gates. Nicely done, but still, all you need to do is read the Intel manuals to know this is possible.

The title is very misleading, this has nothing to do with Windows itself being vulnerable.