# CVE-2022-37969 — Windows CLFS `clfs.sys` Out-of-Bounds Write (ITW 0-day)

---

## Summary

| **Product** | Microsoft Windows — `clfs.sys` (Common Log File System) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **7.8 (High)** |
| **CVE Title** | Windows CLFS Driver Elevation of Privilege Vulnerability |
| **CWE** | CWE-787 (Out-of-bounds Write) |
| **Affected Versions** | Windows 10/11 and Server |
| **Impact** | Local EoP — low-privilege user crafts malicious BLF → SYSTEM |
| **Exploited ITW** | **Yes** — discovered as 0-day by Zscaler ThreatLabz (September 2022) |
| **Patch Date** | September 2022 Patch Tuesday — KB5017328 |
| **Public analysis** | [Zscaler ThreatLabz — Technical Analysis](https://www.zscaler.com/blogs/security-research/technical-analysis-windows-clfs-zero-day-vulnerability-cve-2022-37969-part) |

---

## Root Cause

The Common Log File System (`clfs.sys`) parses Base Log File (`.blf`) metadata
when a log is opened via `CreateLogFile`. The vulnerability is a **crafted-BLF
SignaturesOffset corruption chain**:

1. Attacker crafts a `.blf` with `SignaturesOffset=0x50` overlapping the
   signature array, modified `rgClients` pointing to a fake Client Context with
   `eState=CLFS_LOG_SHUTDOWN`, and an inflated `cbSymbolZone` (0x1114B).

2. When opened:
   - `ClfsDecodeBlockPrivate` writes 0x0050 to sector 13's signature position
   - `ResetLog` writes `CLFS_LSN_INVALID` (0xFFFFFFFF) to the fake client context,
     landing 0xFFFF on sector 14's signature
   - `ClfsEncodeBlockPrivate` writes sector 14's signature (0xFFFF) back to the
     signature array at offset 0x6C, corrupting `SignaturesOffset` to `0xFFFF0050`
   - This bypasses the `cbSymbolZone` bounds check in `AllocSymbol`
   - `AddLogContainer` triggers `AllocSymbol` → `memset` at inflated offset →
     overwrites `pContainer` pointer in adjacent `CLFS_CONTAINER_CONTEXT`

3. Result: **controlled pointer overwrite in kernel pool** → arbitrary read/write
   → EoP to SYSTEM.

### The patch (verified in ghidriff diff — clfs.sys 10.0.22000.832 → 10.0.22000.978)

- **Modified: `CClfsBaseFilePersisted::LoadContainerQ`** (72% match) — now calls
  the new validation suite before accepting any container metadata.
- **Added: `CClfsBaseFile::ValidateOffsets`** and family:
  - `ValidateCheckifWithinSymbolZone`
  - `ValidateClientContextOffsets`
  - `ValidateClientSymTblOffsets`
  - `ValidateContainerContextOffsets`
  - `ValidateContainerSymTblOffsets`
  - `ValidateProcessQNode`
  - `ValidateTraverseTree`
- **Added: `Feature_Servicing_40191887__private_IsEnabled`,
  `Feature_Servicing_41154977__private_IsEnabled`** — gates the validation.
- **Added: `ULongLongAdd`** — safe integer arithmetic helper.
- **Modified: `CClfsRequest::AllocContainer`** (92% match) and
  **`CClfsRequest::DeleteContainer`** (92% match) — synchronized with new bounds.
- The fix validates every offset in the BLF metadata against the symbol zone
  before any write operation, closing the corruption chain.

---

## Reaching the bug — local attack

Reachable from any low-privilege process that can create/open CLFS log files:

```
user process (Medium IL)
    │
    ▼
CreateFile("\\?\\GLOBALROOT\\Device\\Clfs\\MyLog.blf")
    │
    ▼
ntdll!NtCreateFile → clfs!CClfsLogFcbPhysical::Initialize
    │
    ▼
clfs!CClfsBaseFilePersisted::LoadContainerQ
    │   reads attacker-crafted BLF metadata
    ▼
clfs!ClfsDecodeBlockPrivate  ──► writes 0x0050 to sector 13 signature
    │
    ▼
clfs!CClfsLogFcbPhysical::ResetLog ──► writes CLFS_LSN_INVALID to fake client
    │
    ▼
clfs!ClfsEncodeBlockPrivate ──► writes 0xFFFF back, corrupts SignaturesOffset
    │
    ▼
clfs!CClfsBaseFilePersisted::AllocSymbol ──► memset at 0xFFFF0050 → OOB write
    │
    ▼
overwrite pContainer → controlled kernel pointer → EoP
```

| Element | Value |
|---|---|
| Device path | `\Device\Clfs` (via `CreateFile` on `.blf` log file) |
| Vulnerable functions | `clfs!CClfsBaseFilePersisted::AllocSymbol`, `clfs!ClfsEncodeBlockPrivate`, `clfs!ClfsDecodeBlockPrivate`, `clfs!CClfsLogFcbPhysical::ResetLog` |
| Object type | `CLFS_CONTAINER_CONTEXT` / `CLFS_METADATA_BLOCK` (non-paged pool) |
| Privileges | none (standard local user) |
| Exploited ITW | Yes — 0-day discovered in September 2022 |

---

## Detection engineering

- **ETW / kernel tracing**: `Microsoft-Windows-CLFS` provider may show abnormal
  metadata block operations. Correlation with pool corruption bugchecks is a
  strong signal.
- **Crash forensics**: Bugcheck `0x50` (PAGE_FAULT_IN_NONPAGED_AREA) or
  `0x139` (KERNEL_SECURITY_CHECK_FAILURE) in `clfs!CClfsBaseFilePersisted::AllocSymbol`
  or `clfs!ClfsEncodeBlockPrivate`. Verifier may catch OOB write with pool tag `Clfs`.
- **Behavioral tell**: Non-system process creating `.blf` files with unusual
  `SignaturesOffset` / `cbSymbolZone` values is anomalous.

## References

- [MSRC — CVE-2022-37969](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969)
- [Zscaler ThreatLabz — Technical Analysis](https://www.zscaler.com/blogs/security-research/technical-analysis-windows-clfs-zero-day-vulnerability-cve-2022-37969-part)