Downgrade system IL impersonation token to high (#40447)
Downgrade system IL in impersonated token to high IL
Brian Perkins committed
May 7, 2026 at 11:40 UTC
7dd409674e4ee37383c682f05bf686c256cd45e8
1 file changed
+17
-1
src/windows/common/WslSecurity.cpp
+17
-1
@@ -172,7 +172,23 @@ wil::unique_handle wsl::windows::common::security::GetUserToken(_In_ TOKEN_TYPE
172
173
wil::unique_handle newToken;
174
THROW_IF_WIN32_BOOL_FALSE(::DuplicateTokenEx(
175
- contextToken.get(), TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, nullptr, SecurityImpersonation, tokenType, &newToken));
175
+ contextToken.get(),
176
+ TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_DEFAULT,
177
+ nullptr,
178
+ SecurityImpersonation,
179
+ tokenType,
180
+ &newToken));
181
+
182
+ // If the token integrity level is system, reduce it to high integrity level. The VM worker process runs at
183
+ // high integrity level and objects created with a higher integrity level token may be inaccessible.
184
+ if (GetUserBasicIntegrityLevel(newToken.get()) == SECURITY_MANDATORY_SYSTEM_RID)
185
+ {
186
+ auto [sid, sidBuffer] = wsl::windows::common::security::CreateSid(SECURITY_MANDATORY_LABEL_AUTHORITY, SECURITY_MANDATORY_HIGH_RID);
187
+ TOKEN_MANDATORY_LABEL tokenLabel{};
188
+ tokenLabel.Label.Attributes = SE_GROUP_INTEGRITY;
189
+ tokenLabel.Label.Sid = sid;
190
+ THROW_IF_WIN32_BOOL_FALSE(::SetTokenInformation(newToken.get(), TokenIntegrityLevel, &tokenLabel, sizeof(tokenLabel)));
191
+ }
192
193
return newToken;
194
}