Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the Windows Cloud Files Mini Filter Driver (cldflt.sys). During file system operations, the driver improperly handles memory objects. When a cloud-synced file is manipulated, a buffer is freed but the pointer remains referenced. An attacker with low privileges can trigger this by performing specific file operations, such as renaming or deleting files in a synced directory. This causes a use-after-free condition where the freed memory is accessed. By controlling the timing and sequence of operations, the attacker can corrupt kernel memory. This corruption leads to arbitrary code execution in kernel mode. Ultimately, it allows privilege escalation to SYSTEM or administrative rights. The exploit involves crafting IOCTL requests or file system calls to abuse this flaw.
Platform: Windows
Version: 10/11/Server
Vulnerability: Use after free
Severity: High
Date: 2024-07-09
Prediction: 2024-07-09
What Undercode Say:
Analytics
sc query cldflt
driverquery | findstr cldflt
Get-WindowsDriver -Online -Driver cldflt.sys
wmic qfe list full | findstr KB5034441
ver
systeminfo | findstr /B /C:”OS Name” /C:”OS Version”
How Exploit
Trigger file operations.
Corrupt kernel memory.
Execute arbitrary code.
Protection from this CVE
Apply security updates.
Disable vulnerable driver.
Use exploit mitigations.
Impact
Local privilege escalation.
Kernel memory corruption.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
