The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed. The proceedings pap

The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed. The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors. 1. (pdf) https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Domas-Th...