Windows CLFS Exploits Expose Kernel Corruption and SYSTEM Privilege Escalation

Researchers documented distinct exploits targeting the Windows Common Log File System (CLFS), including the actively exploited zero-day CVE-2022-37969. Zscaler ThreatLabz discovered that exploit on September 2, 2022, and reported it to Microsoft, which issued a fix in its September Patch Tuesday updates. The vulnerability enables escalation to SYSTEM on unpatched Windows 10 and Windows 11 systems. Improper bounds checking of the SignaturesOffset field in a crafted base log file permits an out-of-bounds write that bypasses symbol-allocation validation. Zscaler’s published analysis demonstrated kernel container-pointer corruption and a resulting blue screen, rather than the complete privilege-escalation chain.

Separately, Securelist analyzed another CLFS exploit patched in September 2022 as part of research into exploits used by ransomware operators. Researchers explicitly distinguished it from CVE-2022-37969 and did not definitively assign it a CVE, although its code was based on an earlier CVE-2022-24521 exploit. It manipulates base-log-file sector signatures so that enabling log archive mode overwrites a record offset, redirecting processing to a malicious record containing a preset container-object pointer. These findings highlight CLFS as a privilege-escalation target for ransomware operations; defenders should verify that affected Windows systems have the relevant Microsoft security updates installed.