Windows CLFS Exploit Enables Privilege Escalation in Ransomware Attacks

A Windows Common Log File System (CLFS) privilege-escalation vulnerability, CVE-2023-23376, was discovered in active exploitation by Microsoft’s MSTIC and MSRC and patched in February 2023. Securelist analyzed the exploit as part of its investigation into five CLFS exploits used by ransomware operators, detailing how attackers manipulate log-file metadata to gain elevated privileges.

The exploit tampers with the CLFS CONTROL block’s sector signatures and record offsets, substituting malicious metadata after initial index validation. Unchecked block indexes then reach ExtendMetadataBlock, allowing attacker-controlled memory to be treated as a metadata block and enabling an arbitrary memory increment. The exploit turns that capability into privilege escalation through the PreviousMode technique on supported systems, or pipe-attribute corruption that yields arbitrary read/write access on newer Windows 11 builds. Organizations should verify deployment of the February 2023 fix or superseding Windows updates to close this known-exploited escalation path.