CVE-2019-0959

EIP tracks 1 public exploit for CVE-2019-0959. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a race condition in the Windows kernel's CmpAddRemoveContainerToCLFSLog function to create arbitrary directories via mount point abuse, leading to privilege escalation. It requires a race condition win between directory creation and deletion.

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system. The security update addresses the vulnerability by correcting how CLFS handles objects in memory.