Researchers Demonstrate Fabius Bypass of Windows Memory Integrity

Summary

Researchers demonstrated Fabius, a bypass that uses an existing read-write primitive to alter protected kernel behavior while Windows Memory Integrity is enabled. They said the method cannot load unsigned drivers or shellcode.

Key points

• Fabius requires an existing read-write primitive, which could come from a vulnerable driver.
• The method copies protected page contents to a writable page, modifies the copy, and changes the page-frame mapping to point to it.
• In a demonstration using a fictional vault driver, the researchers changed a kernel routine so a user-mode program could dump the vault despite a caller authorization check.
• Replacing a kernel routine can cause a blue screen if other routines on the same page execute unexpectedly.
• The researchers said the bypass does not allow unsigned drivers or shellcode to be loaded and recommended enabling Memory Integrity.