CVE-2022-24481 PoC — Windows Common Log File System Driver Elevation of Privilege Vulnerability

Source

Associated Vulnerability

Description

POC for CLFS CVE-2022-24481

Readme

# CVE-2022-24481-POC

## TL;DR
This poc is reversed from exp(SHA1:fec933b0c46366a1fb272bfaf82a8262597a8d75) and many AV engine detected it as CVE-2022-24521. After analyze it, I find that it maybe the exp for CVE-2022-24481, bacause CVE-2022-24521 is not a type confusion vulnerability.
The bug cause by incorrect of point CLFS_CONTAINER_CONTEXT.pContainer, it will be called in function CClfsContainer::Close, so if it was modified before, and it will execute any code. but how to modify this point?
the RCA of exp(fec933b0c46366a1fb272bfaf82a8262597a8d75) is as follow:
1. exp modify CLFS_BASE_RECORD_HEADER.rgClients to the offset of CLFS_CONTAINER_CONTEXT.
2. in function CClfsLogFcbPhysical::Initialize, read some value into memory from CLFS_BASE_RECORD_HEADER.rgClients(the offset of CLFS_CONTAINER_CONTEXT).
3. CClfsBaseFilePersisted::LoadContainerQ, it will generate the class Container point and fill into CLFS_CONTAINER_CONTEXT.pContainer.
4. in function CClfsRequest::Cleanup, write the value from step 2 into client context which is the same as container context in the memory.
5. in function CClfsRequest::Close, parse CLFS_CONTAINER_CONTEXT and call pContainer(trigger).

File Snapshot

 [4.0K]  /data/pocs/e0506a8304d0c0cc913aad3d9a3dd5912c8e8286
├── [ 21K]  CVE-2022-24481-POC.cpp
└── [1.2K]  README.md

0 directories, 2 files

Remarks