ATI Driver Flaw Exposes Vista Kernel to Attack

Security researchers have discovered a flaw with an ATI driver that allows unsigned and potentially dangerous code to be installed and loaded into the Vista kernel.

In order to increase security and to protect against attack, Microsoft have introduced a new driver signing requirement in Vista. By requiring that drivers are signed, Microsoft hoped that this would ensure that only drivers which were verified as being clean and compatible with Vista could be installed.

ATI duly had their drivers signed by VeriSign so that they could be installed on a Windows Vista system. Unfortunately, their was a flaw in one of the drivers. Apparently the flaw was originally intended as a shortcut in the driver that allowed ATI developers to load modules into the driver for testing. When the driver was released, either no-one thought to remove the shortcut or ATI forgot about it.

In order to close the hole, ATI will have to patch the flaw in their driver, have it signed with a new certificate, roll-out the update via Windows Update, then have the original signing authority revoke the original certificate. It’s not a straightforward process and it’s by no means foolproof either.