NTVDM Flaw Allows Takeover of all 32bit Windows Systems

Virtualization is all the rage in computing these days, but it’s a very old concept. On consumer PCs, hardware support for 16bit virtualization goes back as far as the 80s when the i386 chips were introduced by Intel. There were applications that took advantage of the subsystem but it wasn’t until the launch of the 32bit versions of the Windows operating system that the mode was really used – for emulating a 16bit environment virtually to support old DOS applications. Apparently not much has changed in the code for VDM (Virtual DOS Mode) within Windows as a recently discovered stack manipulation bug allows a console application to spawn new processes with full system privileges. Affecting everything from NT through Windows 7, the bug is easy to avoid by disabling the ability to use NTVDM.

This article was edited after publication by the author on 31 Jan 2010. View changes.