I was researching how old Windows 9x viruses, such as Win95.CIH, got ring0 access, and it's shown that one of the approaches was to get the IDT, hook the interrupt handler and trigger an exception, so the handler is then executed by kernel in ring 0.
Sure, Win 9x is DOS based and intended to let DOS based software run. Not the least of them being drivers. IIRC only Windows ME changed that for good.
Question is - why was it even allowed by Windows 9x to write in this memory area?
Compatibility. Hooking interrupt vectors is a basic technique for many DOS software. More so the file system wasn't really protected in any way - there was no real user management - as such as well was within the capabilities needed for compatibility.
It's also not only the IDT, but the whole basic data about processes that is handeld in real memory (first MiB).
Wasn't it possible to map these virtual addresses to process-specific memory areas and not run the code from there in ring 0?
Windows 9x was a complete different beast than some ivory tower OS or any of it's follow ups. It is important to note that Win 9x was intended to be the best of all worlds, running DOS applications, Running Windows 3.1 16 bit code and 95's 32 bit code. Only the lateer really uses and benefits from memory protection. all other must give way to application programs to change data like Vector tables or system Memory.
** And it was good the way it was.**
After all, it was that capabilities of running old and new code of Win 9x that made it on one side
- a great success for Users as they could continue using their old software while enjoying 32 bit as well, while at the same time
- enabled software companies to create NT compatible software, exactly due creating large user base prior to NT.
Both in combination was what prepared the success XP became.