Then came the ATI driver that could allow arbitrary memory writes to the Vista kernela vulnerability that has been introduced to potentially millions of laptops, given that the driver is preinstalled along with Vista.
Now Symantec's Ollie Whitehouse is pointing out yet another driver vulnerability that actually predates those two: WinPcap, an open-source, packet-sniffing driver used by tools such as Wireshark.
WinPcap (Windows Packet Capture Library), which is used for link-layer network access in Windows environments, allows applications to capture and transmit network packets bypassing the protocol stack and provides kernel-level packet filtering, a network statistics engine and support for remote packet capture.
The developers of the widely used driver added support for Windows x64 in January, as its change log shows, "by digitally signing all the binaries of the WinPcap distribution." Then on July 3, they fixed a bug that involved a system call found on Unix-like systems that allows an application to control or communicate with a device driver outside the usual read/write of data. The bug caused a BSOD (blue screen of death) when passing invalid parameters from the user level.
In Windows NT, 2000, XP, 2003 and yes, Vista, a BSOD happens when the kernel or a driver running in kernel mode can't recover from an error.
Read the rest of this eWEEK story: "Vista Kernel Dogged by Bad Drivers"