OnlyPatch
Windows Cloud Files Mini Filter Driver

CVE-2024-30085 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.1432 🔬 Patch diffed 2024-06 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released Jun 11 2024
Last Updated Jun 11 2024
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.1432 — 0.96282 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.0

EPSS Score

0.1432
probability of exploitation in the next 30 days
0.96282 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

18 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5039227 (Security Update) 5039330 (Security Hotpatch Update) Important Elevation of Privilege 5037782 5037848 Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10.0.20348.2527 10.0.20348.2522 Yes 5039227 Windows Server 2022 (Server Core installation) 5039227 (Security Update) 5039330 (Security Hotpatch Update) Important Elevation of Privilege 5037782 5037848 Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10.0.20348.2527 10.0.20348.2522 Yes 5039227 Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege Yes

Patches

5 patches
Article Type Restart
5039217 Security Update Yes
5039211 Security Update Yes
5039213 Security Update Yes
5039212 Security Update Yes
5039236 Security Update Yes

Patch Diff

ghidriff · cldflt.sys (KB5039211)

Heap-based buffer overflow in cldflt.sys HsmIBitmapNORMALOpen. Allocates 0x1000-byte HsBm paged pool buffer then copies user-controlled reparse data (HSM_DATA BtRp bitmap element) without bounds check. memcpy_size derives from 16-bit Length field in cloud filter reparse point structure. Trigger: CfRegisterSyncRoot + FSCTL_SET_REPARSE_POINT_EX with IO_REPARSE_TAG_CLOUD_6, then reopen file. Full exploit: two-trigger WNF corruption + ALPC handle table spray + PipeAttribute arbitrary read + token privilege overwrite. CVSS 7.8 local EoP to SYSTEM.

Pre-patch version 10.0.22621.3593
Post-patch version 10.0.22621.3810
Function Address Change Note
HsmIBitmapNORMALOpen code (bounds check added before memcpy) Added cmp r14d, 0x1000 check before memcpy of user-controlled reparse data into 0x1000-byte HsBm paged pool allocation. Pre-patch: no size validation, allowing overflow. Post-patch: rejects memcpy_size > 0x1000 with STATUS_BUFFER_OVERFLOW error.
View full diff report View RCA report Download PoC

Attack Path

Local EoP from an unprivileged cloud sync root to SYSTEM via a paged pool overflow in cldflt.sys

Attack path for CVE-2024-30085 Local EoP from an unprivileged cloud sync root to SYSTEM via a paged pool overflow in cldflt.sys 01 — ENTRY Attacker registers a cloud sync root they control CfRegisterSyncRoot() - Cloud Files API. Any authenticated user; no admin rights, no special group membership. 02 — CONTROLLED INPUT Plants a crafted reparse point on a file inside that sync root FSCTL_SET_REPARSE_POINT_EX with tag IO_REPARSE_TAG_CLOUD_6 (0x9000601A). The 16-bit Length field of the nested HSM_DATA BtRp element is fully attacker-controlled, up to 0xFFFF. 03 — PATH Reopening the file drives the NTFS post-create callback into the bitmap loader HsmFltPostCREATE -> HsmiFltPostECPCREATE -> HsmpSetupContexts -> HsmpCtxCreateStreamContext -> HsmIBitmapNORMALOpen 04 — MISSING CHECK HsmIBitmapNORMALOpen copies into a fixed allocation without bounding the length Allocation is always 0x1000 bytes (paged pool, tag HsBm), but memcpy size comes from HSM_DATA.Length. HsmpRpValidateBuffer and HsmpBitmapIsReparseBufferSupported check element types, counts and offsets - none of them checks the total length against the allocation. 05 — PRIMITIVE Paged pool overflow of up to ~0xEFFF bytes into adjacent kernel objects Two-trigger WNF corruption + ALPC handle-table spray + PipeAttribute arbitrary read, then a token privilege overwrite. Local EoP to SYSTEM.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Gwangun Jung( @pr0ln ) and Junoh Lee( @bbbig12 ) at Theori( @theori_io ) working with Trend Micro Zero Day Initiative
Alex Birnberg

On This Page