Re:Google's Project Zero exposes unpatched Windows 10 lockdo...
by pjc50 on Saturday April 21, 2018 @04:31AM
(#16890528)
There is a lockdown mode which restricted which COM objects could be instantiated from .net code to a short whitelist.
The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry.
COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.
The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry.
COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.