OnlyPatch
Windows Common Log File System Driver

CVE-2023-28252 — Windows Common Log File System Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.48973 ⚠️ Exploited in the wild 🔬 Patch diffed 2023-04 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Exploited
MS Exploit Status
Exploitation Detected
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released Apr 11 2023
Last Updated Apr 11 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.48973 — 0.98776 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Functional
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.2

EPSS Score

0.48973
probability of exploitation in the next 30 days
0.98776 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

25 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5025234 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5025234 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5025228 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5025228 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5025224 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5025224 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5025239 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5025239 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 R2 for x64-based Systems Service Pack 1 5025279 (Monthly Rollup) 5025277 (Security Only) Important Elevation of Privilege 5023769 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5025279 (Monthly Rollup) 5025277 (Security Only) Important Elevation of Privilege 5023769 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2012 5025287 (Monthly Rollup) 5025272 (Security Only) Important Elevation of Privilege 5023769 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 (Server Core installation) 5025287 (Monthly Rollup) 5025272 (Security Only) Important Elevation of Privilege 5023769 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 R2 5025285 (Monthly Rollup) 5025288 (Security Only) Important Elevation of Privilege 5023765 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2012 R2 (Server Core installation) 5025285 (Monthly Rollup) 5025288 (Security Only) Important Elevation of Privilege 5023765 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2016 5025228 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5025228 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5025229 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5025229 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5025230 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5025230 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5025234 Security Update Yes
5025228 Security Update Yes
5025229 Security Update Yes
5025221 Security Update Yes
5025224 Security Update Yes
5025239 Security Update Yes
5025230 Security Update Yes

Patch Diff

ghidriff · clfs.sys (KB5025239)

OOB read/write via iExtendBlock/iFlushBlock=0x13 in BLF control record. ExtendMetadataBlock and WriteMetadataBlock use these as array indices without bounds check. OOB write gives 1-byte increment primitive → CONTAINER_CONTEXT redirect → vtable hijack at 0x5000000. Fix: broad BLF validation in GetControlRecord (3x growth) + WriteMetadataBlock encode check + ValidateScratchBlockOffsets (2x growth). Gated on g_signatureOffsetsValidation. Exploited ITW by Nokoyawa ransomware.

Pre-patch version 10.0.22621.1265 Download
Post-patch version 10.0.22621.1555 Download
Function Address Change Note
CClfsBaseFile::GetControlRecord code, length, address, called 3x growth (299→891 bytes). Validates iExtendBlock/iFlushBlock must be 2-3, block descriptor monotonicity, sector size consistency
CClfsBaseFilePersisted::WriteMetadataBlock code, length, address, called ClfsEncodeBlock return value now checked; write skipped on encode failure; conditional decode in cleanup
CClfsBaseFile::ValidateScratchBlockOffsets code, fullname, length, sig, address, called 2x growth (743→1519 bytes). Moved to CClfsLogFcbPhysical::. Reads scratch block from disk and validates sector counts, owner page offsets, monotonicity
CClfsBaseFile::AcquireMetadataBlock code, length, address, called, calling Null pointer check after metadata block acquisition; new caller ValidateScratchBlockOffsets
CClfsLogFcbPhysical::AppendRegion code, length, address Significant restructuring for bounds checking
ClfsDecodeBlockPrivate code, length, address Sector signature validation during decode
View full diff report View RCA report Download PoC

Attack Path

Local EoP to SYSTEM via unvalidated rgBlocks[] indices in a crafted CLFS base log file - exploited in the wild by Nokoyawa ransomware

Attack path for CVE-2023-28252 Local EoP to SYSTEM via unvalidated rgBlocks[] indices in a crafted CLFS base log file - exploited in the wild by Nokoyawa ransomware 01 — ENTRY Attacker creates a base log file in any user-writable directory CreateLogFile() - CLFS is a core kernel component present on every Windows install. Standard user; no admin rights, no driver, no user interaction. 02 — CONTROLLED INPUT Crafts the .blf control record with out-of-range block indices iExtendBlock (file offset 0x488) and iFlushBlock (0x48a) both set to 0x13. Valid range is 2-3; rgBlocks[] holds at most 6 entries. 03 — PATH Opening the log parses the control record; AddLogContainer reaches the metadata block handlers CreateLogFile -> ReadImage -> CClfsBaseFile::GetControlRecord (reads both indices unvalidated). Then AddLogContainer -> DeviceIoControl IOCTL 0x8007a808 -> CClfsRequest::Dispatch -> AllocContainer -> AddContainer -> ExtendMetadataBlock / WriteMetadataBlock. 04 — MISSING CHECK ExtendMetadataBlock and WriteMetadataBlock index rgBlocks[] with the file-supplied value No bounds check on iExtendBlock/iFlushBlock before use as an array index. Patch adds validation in GetControlRecord, rejecting indices outside the valid range at parse time. 05 — PRIMITIVE OOB read of a sprayed pointer, then a 1-byte OOB increment redirects a CONTAINER_CONTEXT Named-pipe pool spray places a controlled kernel pointer in the adjacent allocation. inc qword ptr [rax+r14] moves rgContainers[0] from 0x1470 to 0x1570, pointing at a fake context whose vtable lives in user space at 0x5000000 - kernel code execution, token swap to SYSTEM.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Boris Larin (oct0xor)
Quan Jin with DBAPPSecurity WeBin Lab
Genwei Jiang with Mandiant

On This Page