A Flaw in Windows Update Opens the Door to Zombie Exploits

Research presented at Black Hat describes a Windows Update vulnerability (“Downdate”) discovered by SafeBreach Labs that lets an attacker manipulate the update action list (via an unlocked PoqexecCmdline key) to downgrade Windows components and security mechanisms — including drivers, DLLs, the NT kernel, VBS, Secure Kernel, Credential Guard and the hypervisor — thereby exposing known, patched vulnerabilities and enabling potential kernel-level compromise; Microsoft is working on a complex patch process.