Patch Tuesday - December 2024

Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and public disclosure for one of the vulnerabilities published today, and this is reflected in a CISA KEV entry. For the third month in a row, Microsoft has published...

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Common Log File System CLFS driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges...

The vulnerability of the CLFS driver for Microsoft Windows operating systems allows a hacker to gain increased privileges.

The vulnerability of the CLFS driver in Microsoft Windows operating systems is related to errors in privilege management. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level using a specially crafted blk-file...

The vulnerability of the Windows Common Log File System (CLFS) driver in Windows operating systems allows a hacker to gain elevated privileges.

The vulnerability of the Windows Common Log File System CLFS driver in Windows operating systems is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the driver responsible for the computer’s interaction with the CLFS.sys device in the Windows operating system allows a hacker to trigger a Service-Breaking Failure (BSoD).

The vulnerability of the driver responsible for the computer’s interaction with CLFS.sys devices and devices in the Windows operating system is related to incorrect configuration data input. Exploiting this vulnerability can cause a Service-Breaking Failure BSoD through the forced invocation of t...

(Pwn2Own) Microsoft Windows CLFS Integer Underflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Common Log Fil...

Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days

Microsoft has addressed a total of 61 new security flaws in its software as part of its Patch Tuesday updates for May 2024, including two zero-days which have been actively exploited in the wild. Of the 61 flaws, one is rated Critical, 59 are rated Important, and one is rated Moderate in severity...

Microsoft Common Log File System Elevation of Privilege Vulnerability

The Microsoft Common Log File System is Microsoft's Common Log File System CLFS API provides a log file subsystem that can be used by dedicated client applications and shared by multiple clients to optimize log access. Microsoft Common Log File System elevation of privilege vulnerability. An...

Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities

Microsoft has addressed a total of 48 security flaws spanning its software as part of its Patch Tuesday updates for January 2024. Of the 48 bugs, two are rated Critical and 46 are rated Important in severity. There is no evidence that any of the issues are publicly known or under active attack at...

Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)

This is part four of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can skip to the other parts using this table of...

Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)

This is the third part of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can skip to the other parts using this tab...

Windows CLFS and five exploits used by ransomware operators

In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft. In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows...

Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)

This is the second part of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you havent already. You can skip to the other parts using this tab...

PT-2023-9403 · Microsoft · Windows 11 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 affected versions not specified Description: A Denial of Service in the CLFS.sys driver allows a malicious authenticated low-privilege user to...

Exploit for Integer Overflow or Wraparound in Microsoft

CVE-2023-36900 - About this vulnerability: https://msrc.micros...

Buffer Overflow

libzephyr.so is vulnerable to Buffer Overflows. The vulnerability is caused by the CLFS driver. An attacker is able to exploit this vulnerability by sending a specially crafted log file to a vulnerable system. If the log file is processed by the CLFS driver, the buffer overflow can be triggered,...

Microsoft Windows CLFS Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Microsoft Windows CLFS Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the CLF...

Microsoft Windows CLFS Incorrect Integer Conversion Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the clfs.sys drive...

Exploit for Out-of-bounds Write in Microsoft

Since February 2022 was reported a new ransomware that appears t...