Local Privilege Escalation

Every operating system divides its users into levels. A normal user is allowed to read their own files and launch programs. An administrator — on Linux often called “root” — on the other hand, is allowed to do everything: modify system files, delete other users, disable security programs. Local Privilege Escalation, LPE for short, refers to the process by which someone jumps from a lower level to a higher one without having the system’s permission to do so. The attacker is therefore already on the device — they have already gained access somehow — and now wants to gain more control. How they got onto the device in the first place is a separate problem.

Why a restricted account isn’t secure enough

One might think: if an attacker only controls a normal user account, the damage is limited. That’s true in the short term, but rarely in the long run. Without admin rights, the attacker cannot, for example, embed malware deep within the system, disable antivirus programs, or read out other user accounts. This is exactly why LPE is so valuable to attackers: it’s the step that turns a partial success into a complete system compromise.

In corporate networks, this is especially critical. There, a single administrator often has control over hundreds of devices. Whoever takes over that administrator’s rights can spread throughout the entire network. Security teams therefore implement the principle of least privilege — every user and every process is given only as many rights as it needs for its task. This shrinks the attack surface, but does not eliminate LPE risks.

How attackers trick their way into higher privileges

The most common method exploits vulnerabilities in the operating system or in drivers — that is, in the software that controls hardware such as graphics cards or printers. Drivers often run with full system privileges because they need to communicate directly with the hardware. If a driver contains a programming error, an attacker can exploit it to execute their own code with the same elevated privileges. A well-known example is the Windows vulnerability CVE-2021-34527, known as “PrintNightmare”: a flaw in the print spooler service allowed normal users to execute code as administrator.

Another method involves incorrectly set file permissions. If a program running with admin rights uses a configuration file that normal users are also allowed to modify, an attacker can manipulate that file. The program then reads it with elevated privileges — and executes whatever the attacker wrote into it. Such errors are often caused not by malicious intent but by carelessness during setup.

There are also token manipulations: Windows issues so-called access tokens, essentially digital ID cards that determine which privileges a running program has. Certain vulnerabilities make it possible to copy or forge such an ID card — thereby assuming the identity of a privileged process.

LPE in security advisories and real-world attacks

LPE vulnerabilities appear regularly in security updates. Microsoft, Apple, and Linux distributors release patches — that is, fixes — every month, some of which close such gaps. In the assessments of these updates, you frequently find the term “Elevation of Privilege,” the English umbrella term for privilege escalation. Depending on severity, such a vulnerability is often given a score between 7 and 9 on the CVSS scale, a standard for rating security vulnerabilities from 0 to 10.

In practice, LPE vulnerabilities are rarely the first step of an attack, but almost always the second. Ransomware — extortion software that encrypts data — generally needs admin rights to be effective. Attackers therefore combine a vulnerability that grants them initial access with an LPE flaw that gives them full control. Browser vendors also invest heavily in preventing LPE attacks launched from so-called sandboxes — because even a browser tab that manages to break out of its isolated environment usually still needs an LPE to cause lasting damage afterward.