Windows CLFS Use-After-Free Exploit Enables Local Privilege Escalation

Exodus Intelligence detailed a local privilege-escalation exploit against clfs.sys, the Windows kernel driver implementing the Common Log File System (CLFS). Attacker-controlled metadata in a crafted Base Log File causes CLFS to free a buffer shared with a shadow metadata block, then restore a dangling pointer; closing the file handle can subsequently trigger a double free. Microsoft patched the flaw and two similar vulnerabilities in September 2021 under CVE-2021-36955, CVE-2021-36963, and CVE-2021-38633. The researcher used CVE-2021-36955 to identify the analyzed flaw because public information did not distinguish the three vulnerabilities.

The exploit combines pipe attributes and Windows Notification Facility objects to manipulate the kernel heap, obtain out-of-bounds kernel-memory access, and modify a newly created process’s token to enable all privileges. The disclosure demonstrates how malformed CLFS log metadata can turn local access into elevated privileges on vulnerable Windows systems; the supplied references do not report exploitation in the wild. Organizations should verify that affected systems have the September 2021 fixes or superseding cumulative updates installed, prioritizing hosts where untrusted users or compromised applications could exercise local access.