erev comments on Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability

[–] erev@lemmy.world 2 points 2 years ago (2 children)

depends, they can also loaded via dkms which may not require it

parent

[+] skullgiver@popplesburger.hilciferous.nl 2 points 2 years ago (1 child)

[deleted]

parent

[–] erev@lemmy.world 2 points 2 years ago

It kinda depends, on custom kernels DKMS can be incredibly helpful. Like for a hardened kernel, a lot of drivers may be loaded via DKMS.

parent

[–] jlh@lemmy.jlh.name 1 point 2 years ago

Yeah, it actually looks like Ubuntu leaves the module signing key accessible to root on the filesystem:

So root access basically gives you kernel access, if you just sign a malicious kernel module with the MOK.

parent

lemmy:	0.19.20
mlmym (mschae):	26.3.4