# CVE-2021-36955 — Windows CLFS `clfs.sys` Use-After-Free

---

## Summary

| **Product** | Microsoft Windows — `clfs.sys` (Common Log File System) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **7.8 (High)** |
| **CVE Title** | Windows CLFS Elevation of Privilege Vulnerability |
| **CWE** | CWE-416 (Use After Free) |
| **Affected Versions** | Windows 10/11 and Server |
| **Impact** | Local EoP — low-privilege user triggers UAF in kernel pool → SYSTEM |
| **Exploited ITW** | No |
| **Patch Date** | September 2021 Patch Tuesday |
| **Public analysis** | [Exodus Intelligence — CLFS UAF](https://blog.exodusintel.com/2022/03/10/exploiting-a-use-after-free-in-windows-common-logging-file-system-clfs/) |

---

## Root Cause

The Common Log File System (`clfs.sys`) is a kernel-mode logging subsystem
used by Windows components and third-party drivers. Log files are organized
into **containers** (physical files) described by **base block** metadata.

Two functions manage base block metadata:

- **`ExtendMetadataBlockDescriptor`** — extends the metadata block when the log
  grows.
- **`ReadMetadataBlock`** — reads metadata blocks from disk into memory.

The UAF occurs when:

1. A metadata block is read into a pool allocation by `ReadMetadataBlock`.
2. `ExtendMetadataBlockDescriptor` frees this allocation during a block
   extension/reallocation.
3. A stale pointer to the freed block remains in a descriptor or cache
   structure.
4. Subsequent access (e.g., another read or validation pass) dereferences the
   freed block — **use-after-free in kernel pool**.

The freed object is a `CLFS_METADATA_BLOCK` (or similar internal structure)
allocated from the non-paged pool. With pool grooming, the attacker can replace
the freed object with a controlled allocation and achieve arbitrary read/write
in kernel space.

### The patch (verified in ghidriff diff — clfs.sys 10.0.19041.1052 → 10.0.19041.1237)

- **Modified: `CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor`** (79 % match)
  — size calculations now use safe integer arithmetic.
- **Added: `RtlULongAdd`, `RtlULongMult`** — Microsoft-supplied safe arithmetic
  helpers added to the driver to prevent integer wrap-around.
- **Deleted: `Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721`** and
  its WIL reporting infrastructure — the feature gate is no longer referenced.
- The fix replaces raw addition/multiplication in metadata block size
  calculations with `RtlULongAdd` / `RtlULongMult`. This prevents integer
  wrap-around that previously led to an undersized pool allocation, which was
  later freed and left as a stale pointer — closing the UAF path.

---

## Reaching the bug — local attack

Reachable from any low-privilege process that can create/open CLFS log files:

```
user process (Medium IL)
    │
    ▼
CreateFile("\\?\\GLOBALROOT\\Device\\Clfs\\MyLog.blf")
    │
    ▼
ntdll!NtCreateFile → clfs!CClfsLogFcbPhysical::Initialize
    │
    ▼
clfs!ReadMetadataBlock  ──► pool alloc for metadata block
    │
    ▼
DeviceIoControl / FSCTL that triggers log growth
    │
    ▼
clfs!ExtendMetadataBlockDescriptor
    │   frees old block, but descriptor still points to it
    ▼
clfs!ReadMetadataBlock  (or similar) ──► dereferences freed block → UAF
```

| Element | Value |
|---|---|
| Device path | `\Device\Clfs` (via `CreateFile` on `.blf` log file) |
| Vulnerable functions | `clfs!ExtendMetadataBlockDescriptor`, `clfs!ReadMetadataBlock` |
| Object type | `CLFS_METADATA_BLOCK` (non-paged pool) |
| Privileges | none (standard local user) |
| Race | Not required — deterministic via controlled log growth sequence |

---

## Detection engineering

- **ETW / kernel tracing**: `Microsoft-Windows-CLFS` provider may show abnormal
  metadata block operations. Correlation with pool corruption bugchecks is a
  strong signal.
- **Crash forensics**: Bugcheck `0x50` (PAGE_FAULT_IN_NONPAGED_AREA) or
  `0x139` (KERNEL_SECURITY_CHECK_FAILURE) in `clfs!ReadMetadataBlock` or
  `clfs!ExtendMetadataBlockDescriptor`. Verifier may catch UAF with pool tag
  `Clfs`.
- **Behavioral tell**: Non-system process creating `.blf` files and issuing
  repeated FSCTLs to trigger log growth is anomalous.

## References

- [MSRC — CVE-2021-36955](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36955)
- [Exodus Intelligence — CLFS UAF](https://blog.exodusintel.com/2022/03/10/exploiting-a-use-after-free-in-windows-common-logging-file-system-clfs/)