Definition
Privilege escalation gains higher access rights:
\text{Privilege}_{initial} \rightarrow \text{Privilege}_{higher}
In SCU terms: Privilege escalation modifies χ-mode access controls—granting unauthorized access to protected information states.
Privileges as χ-Mode Gates
Access controls determine which χ-modes are accessible:
| Privilege Level | χ-Mode Access |
|---|---|
| User | Own χ-mode resources |
| Admin | All user χ-modes |
| Root/System | All χ-mode states |
| Kernel | Hardware χ-mode control |
Escalation Types
| Type | χ-Mode Transition |
|---|---|
| Vertical | User → Admin χ-mode access |
| Horizontal | Access other user's χ-modes |
| Local | Same system escalation |
| Network | Cross-system escalation |
Attack Vectors
| Vector | How It Works |
|---|---|
| Kernel exploit | Corrupt kernel χ-mode state |
| Setuid abuse | Inherit elevated χ-mode rights |
| Misconfiguration | Exploit weak χ-mode permissions |
| Credential theft | Steal privileged χ-mode tokens |
The Attack Chain
Initial access often has limited privileges:
\text{Foothold} \xrightarrow{\text{escalation}} \text{Admin} \xrightarrow{\text{escalation}} \text{Root}
Each step expands χ-mode access.
Prevention
| Defense | χ-Mode Protection |
|---|---|
| Least privilege | Minimal χ-mode rights granted |
| Privilege separation | Isolate χ-mode domains |
| Regular patching | Fix χ-mode escalation bugs |
| Monitoring | Detect χ-mode privilege changes |
Why It Matters
Limited access → full control:
P(\text{compromise} | \text{escalation}) \approx 1
Privilege escalation enables:
- Data exfiltration (all χ-modes readable)
- Persistence (modify system χ-modes)
- Lateral movement (access network χ-modes)
The Key Insight
Privileges gate χ-mode access.
Escalation breaks χ-mode boundaries:
- Access controls protect information states
- Escalation bypasses these controls
- Full privileges = full χ-mode access
- Prevention requires defense in depth
When an attacker escalates privileges, they're gaining access to χ-mode states that should be protected—converting limited access into comprehensive system control.