# CVE-2021-43224 — Windows CLFS `clfs.sys` Stack Buffer Overwrite

---

## Summary

| **Product** | Microsoft Windows — `clfs.sys` (Common Log File System) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **7.8 (High)** |
| **CVE Title** | Windows CLFS Driver Information Disclosure Vulnerability |
| **CWE** | CWE-787 (Out-of-bounds Write) |
| **Affected Versions** | Windows 10/11 and Server |
| **Impact** | Local — low-privilege user triggers stack buffer overwrite → BSOD / info disclosure |
| **Exploited ITW** | No |
| **Patch Date** | December 2021 Patch Tuesday — KB5008215 |
| **Public analysis** | [vang3lis — CVE-2021-43224 Analysis](https://vang3lis.github.io/2022/09/13/CVE-2021-43224%20%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/) |

---

## Root Cause

The Common Log File System (`clfs.sys`) handles `GetLogFileInformation` requests
via `CClfsLogFcbVirtual::QueryLogFileInfo`. The function copies log metadata into
a caller-supplied output buffer:

```c
// Simplified vulnerable path
memset(dest_buffer, 0, infoSize);  // infoSize is user-controlled!
```

The `infoSize` parameter is passed directly from user mode **without clamping**
to the actual output buffer size (0x78 bytes / `sizeof(CLFS_INFORMATION)`).
When `infoSize=0x110` (or larger) is passed:

1. `memset` zeroes past the 0x78-byte stack buffer
2. Stack cookie is overwritten
3. Return address is corrupted
4. Function return triggers `KERNEL_SECURITY_CHECK_FAILURE` (bugcheck 0x139) — BSOD

While the immediate effect is a denial-of-service (BSOD), the overwrite pattern
is partially attacker-controlled (the zero-fill can be observed in crash dumps),
making it an information-disclosure primitive.

### The patch (verified in ghidriff diff — clfs.sys 10.0.22000.258 → 10.0.22000.376)

- **Modified: `CClfsLogFcbVirtual::QueryLogFileInfo`** (53% match) — completely
  rewritten to clamp `infoSize` to `min(infoSize, 0x78)` before the `memset`.
- **Added: `CClfsBaseFile::ValidateContainerOffsets`** — new validation helper
  that sorts and validates container context offsets using `qsort` and
  `CompareOffsets`.
- **Added: `CompareOffsets`** — qsort comparator for offset validation.
- **Modified: `CClfsBaseFilePersisted::LoadContainerQ`** (14% match) — major
  rewrite to integrate the new validation suite.
- **Modified: `CClfsBaseFile::FindSymbol`** (31% match) — hardened symbol lookup.
- The fix clamps the input size and adds comprehensive container offset
  validation to prevent any out-of-bounds access path.

---

## Reaching the bug — local attack

Reachable from any low-privilege process that can open a CLFS log file:

```
user process (Medium IL)
    │
    ▼
CreateLogFile("\\?\\GLOBALROOT\\Device\\Clfs\\MyLog.blf", OPEN_ALWAYS)
    │
    ▼
RegisterManageableLogClient(hLog)
    │
    ▼
GetLogFileInformation(hLog, &infoBuffer, &infoSize=0x110)
    │   infoSize is user-controlled, not validated
    ▼
clfs!CClfsLogFcbVirtual::QueryLogFileInfo
    │   memset(dest, 0, 0x110) — writes 0x98 bytes past stack buffer
    ▼
stack cookie overwritten → KERNEL_SECURITY_CHECK_FAILURE (0x139) → BSOD
```

| Element | Value |
|---|---|
| Device path | `\Device\Clfs` (via `CreateLogFile` on `.blf` log file) |
| Vulnerable functions | `clfs!CClfsLogFcbVirtual::QueryLogFileInfo`, `clfs!CClfsLogFcbPhysical::QueryLogFileInfo` |
| Buffer | 0x78-byte stack buffer (`CLFS_INFORMATION`) |
| Privileges | none (standard local user) |
| Trigger | `GetLogFileInformation` with `infoSize > 0x78` |

---

## Detection engineering

- **ETW / kernel tracing**: `Microsoft-Windows-CLFS` provider showing
  `GetLogFileInformation` calls with abnormally large `infoSize` values.
- **Crash forensics**: Bugcheck `0x139` (KERNEL_SECURITY_CHECK_FAILURE) in
  `clfs!CClfsLogFcbVirtual::QueryLogFileInfo` with a corrupted stack cookie.
  The `infoSize` parameter on the stack will be > 0x78.
- **Behavioral tell**: Non-system process repeatedly opening `.blf` files and
  calling `GetLogFileInformation` with varying large sizes is anomalous.

## References

- [MSRC — CVE-2021-43224](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43224)
- [vang3lis — CVE-2021-43224 Analysis](https://vang3lis.github.io/2022/09/13/CVE-2021-43224%20%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/)
- [GitHub PoC](https://github.com/KaLendsi/CVE-2021-43224-POC)