Hackers exploit gaping Windows loophole to give their malware kernel access

Microsoft blocks a new batch of system drivers, but the loophole empowering them remains.

See full article...

 

[afidel]

It would still be reasonable to make this a system policy for opt-in, or potentially opt-out, so that unless you need this vulnerability left open, you have the option to close it (as already mentioned in another comment).

The problem is, if I understand the problem correctly, is that exploiting this vulnerability already requires administrator credentials, so any opt-in mechanism would be worthless as the process running as the admin user could simply modify the policy from opt-out to opt-in. In fact I'm not sure there's an effective mitigation as any updated DLLs could likely just be rolled back to vulnerable versions, or the attacker could redirect the function calls to a vulnerable DLL version in another location. Basically if you have administrator permissions you already effectively have SYSTEM permissions as you can undo any security mechanism that's put in place.