Windows Common Log File System Driver Elevation of Privilege VulnerabilityVendor advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24481 CVE-2022-24481
HIGH
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Record summary
CVE-2022-24481 has a selected CVSS score of 7.8 (high); EIP currently links 2 repository PoCs.
Description
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24521.
Description source: GitHub Advisory
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Aug 20, 2025 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Repository PoCs
- 2
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated May 29, 2024 · Source: CVE List
Affected products and versions
Showing 12 of 26| Product | Source | Version range | Status |
|---|---|---|---|
WindowsBrowse Microsoft / Windows | VulnCheck | Version data not supplied | |
Windows 10 Version 1507Browse Microsoft / Windows 10 Version 1507 | CVE List | 10.0.10240.0 to < 10.0.10240.19265 | affected |
Windows 10 Version 1607Browse Microsoft / Windows 10 Version 1607 | CVE List | 10.0.14393.0 to < 10.0.14393.5066 | affected |
Windows 10 Version 1809Browse Microsoft / Windows 10 Version 1809 | CVE List | 10.0.17763.0 to < 10.0.17763.2803 | affected |
| 10.0.0 to < 10.0.17763.2803 | affected | ||
Windows 10 Version 1909Browse Microsoft / Windows 10 Version 1909 | CVE List | 10.0.0 to < 10.0.18363.2212 | affected |
Windows 10 Version 20H2Browse Microsoft / Windows 10 Version 20H2 | CVE List | 10.0.0 to < 10.0.19042.1645 | affected |
Windows 10 Version 21H1Browse Microsoft / Windows 10 Version 21H1 | CVE List | 10.0.0 to < 10.0.19043.1645 | affected |
Windows 10 Version 21H2Browse Microsoft / Windows 10 Version 21H2 | CVE List | 10.0.19043.0 to < 10.0.19044.1645 | affected |
Windows 11 version 21H2Browse Microsoft / Windows 11 version 21H2 | CVE List | 10.0.0 to < 10.0.22000.613 | affected |
Windows 7Browse Microsoft / Windows 7 | CVE List | 6.1.0 to < 6.1.7601.25924 | affected |
Windows 7 Service Pack 1Browse Microsoft / Windows 7 Service Pack 1 | CVE List | 6.1.0 to < 6.1.7601.25924 | affected |
Windows 8.1Browse Microsoft / Windows 8.1 | CVE List | 6.3.0 to < 6.3.9600.20337 | affected |
Proofs of concept
2Repository PoCs
GitHubuname1able/CVE-2022-24481Repository PoCby uname1ableStars: 0Exploit20 files
Analysis
Technical assessment
The artifact contains two C++ programs (win10_poc.cpp and win11_poc.cpp) that exploit CVE-2022-24481, a Windows Common Log File System (CLFS) driver elevation of privilege vulnerability. The code crafts a malicious .blf log file, triggers the vulnerability via CreateLogFile, and uses kernel memory manipulation to replace the current process token with a SYSTEM token, ultimately spawning an elevated command prompt.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC code for CVE-2022-24481 performs expected privilege escalation steps: it creates and manipulates CLFS log files, triggers the vulnerability, and then replaces the current process token with a SYSTEM token to launch a command prompt. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text files.
ClassificationExploit
Model confidence95%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by crafting a malicious .blf file, triggering the kernel bug, and using the resulting arbitrary kernel read/write to replace the process token with a SYSTEM token, ultimately spawning an elevated command prompt. This is a full end-to-end exploit, not merely a scanner or writeup.
win10_poc/win10_poc.cpp:87-157win11_poc/win11_poc.cpp:207-261Requirements
- Low-privilege user execution on a vulnerable Windows version (e.g., Windows 10 21H2, Windows 11 21H2).
README.md:3-5 - Ability to create and modify CLFS log files and containers in the current directory.
win10_poc/win10_poc.cpp:31-51 - Requires kernel function addresses (ClfsEarlierLsn, SeSetAccessStateGenericMapping) obtained via GetKernelFunctionAddresses.
win10_poc/win10_poc.cpp:122
Observed behavior
- Creates a CLFS log file and container, then parses and modifies the .blf file to inject a fake container object pointer and virtual table address (0x50000).
win10_poc/win10_poc.cpp:31-116 - Sets up a fake virtual table in user-controlled memory at 0x50000 with gadget addresses to redirect kernel execution.
win10_poc/win10_poc.cpp:122-124 - Triggers the vulnerability by calling CreateLogFile with specific flags, causing the kernel to process the corrupted .blf file and execute the fake virtual table.
win10_poc/win10_poc.cpp:133 - Uses the vulnerability to achieve arbitrary kernel read/write, reads the SYSTEM token pointer, and overwrites the current process token to elevate privileges.
win11_poc/win11_poc.cpp:227-258 - Spawns an elevated command prompt (cmd.exe) after successful token replacement.
win10_poc/win10_poc.cpp:155-157
Behaviors behind the backdoor verdict
Observables
- Privilege Escalation Technique
- Payload withheldThe win11 PoC reads a SYSTEM token pointer from kernel memory and writes it to the current process token field, then launches cmd.exe. This is standard behavior for a local privilege escalation exploit targeting the described CVE.
win11_poc/win11_poc.cpp:227-261 - Privilege Escalation Technique
- Payload withheldThe win10 PoC modifies the thread's PreviousMode to bypass kernel-mode checks, then replaces the token and launches cmd.exe. This is consistent with a Windows kernel EoP exploit.
win10_poc/win10_poc.cpp:126-158 - Exploit Trigger
- Payload withheldBoth PoCs call CreateLogFile with specific flags (0xC0010000, 3, 0, 4, 0) to trigger the CLFS vulnerability, followed by NtSetInformationFile. This matches the expected exploit flow for CVE-2022-24481.
win10_poc/win10_poc.cpp:133-149win11_poc/win11_poc.cpp:158-175
What the analysis did not establish
- 14 binary files (e.g., ParseBLF.h, Gadget.h, kernel_utils.h) are flagged as binary and not analyzed; their content is opaque, so the full exploit logic (e.g., Memory_prepare, GetTokenAddresses) cannot be fully verified from the provided text alone.
- The evidence does not include the token_operations.h file referenced in win10_poc.cpp, limiting analysis of the token replacement mechanism in that variant.
- The code is not executed; classification is based solely on static analysis of the provided source text.
- 14 binary header files (e.g., ParseBLF.h, Gadget.h, kernel_utils.h) were not inspected; they are flagged as BINARY and only metadata was reviewed. These files likely contain exploit support code, but their content is unreadable in this evidence packet.
- 3 additional text files in the repository were not included in the evidence packet, so their content is unknown.
- The review is limited to static analysis of the provided source code excerpts; no dynamic analysis or execution was performed.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubfr4nkxixi/CVE-2022-24481-POCRepository PoCby fr4nkxixiStars: 14Not analyzed2 files
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-24481 portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24481