Windows CLFS Exploit Enables SYSTEM Privileges in Ransomware Attacks

Ransomware operators used an exploit for CVE-2022-24521, a privilege-escalation vulnerability in the Windows Common Log File System (CLFS) that was exploited as a zero-day before Microsoft patched it in April 2022. Following the patch, researchers observed dark-web advertisements for a one-day exploit and subsequent attacks using an implementation with artifacts indicating post-patch development. The original zero-day operator and exploitation method remain unidentified.

The analyzed exploit manipulates a CLFS base log file (BLF), overlapping client and container structures so that an attacker-controlled address is interpreted as a kernel object pointer. This enables an arbitrary kernel-memory decrement, which attackers use to alter a thread’s PreviousMode flag, gain kernel-memory read and write access, and replace a process token to obtain SYSTEM privileges. Shared debug strings and code similarities suggest a common developer behind five CLFS exploits examined by researchers. Organizations should verify deployment of the applicable Windows security updates, particularly on systems where an initial compromise could escalate into ransomware execution.