# CVE-2024-38196 — Windows Common Log File System `clfs.sys` Under-Validated Base-Log-File Offsets → Improper Input Validation

---

## Summary

| | |
|---|---|
| **Product** | Windows — `clfs.sys` (Common Log File System driver) |
| **CVE ID** | CVE-2024-38196 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-20: Improper Input Validation |
| **Delivery** | Local — a crafted CLFS base log file (`.blf`) |
| **KB / Fixed build** | KB5041571 — `clfs.sys` 10.0.26100.1455 (Win11 24H2 x64) |
| **Patch Date** | August 13, 2024 (2024-Aug) |
| **Pre-patch binary** | `clfs.sys` 10.0.26100.1301 — SHA256 `12ea662173adb00e038c8d9403e749ed73fb09b752a58430c8518eb670f0fe0b` |
| **Post-patch binary** | `clfs.sys` 10.0.26100.1455 — SHA256 `b1782f78ca4f26082d331c269a7a3e554461963016746502efea481ff9cc3b13` |
| **Feature flag** | `Feature_110180665` / `Feature_1868496191` / `Feature_2458037564` — **CFR-gated** |
| **Exploitability** | Exploitation **More Likely**; not publicly disclosed; not exploited (per MSRC) |

> Sourcing note: the OS fixed build is `.1457`; the `clfs.sys` binary in KB5041571 is
> versioned `.1455`. Pre = `.1301`.

---

## Product Description

`clfs.sys` is the Common Log File System driver. A **base log file** (`.blf`) holds a
control record plus client contexts, container contexts and symbol tables — a
structure full of **self-referential offsets** that CLFS resolves (`OffsetToAddr`,
`GetSymbol`, `GetControlRecord`) when opening/parsing the log
(`CClfsBaseFilePersisted::OpenImage` / `CreateImage`). CLFS `.blf` parsing is a
long-standing local EoP attack surface because a user can supply a crafted log file.

---

## Vulnerability Summary

Pre-patch, the offset/length fields in the base-file metadata were **not fully
validated** before use. A crafted `.blf` could set client-context / container-context
/ region offsets that point **outside the valid region (symbol zone)**, so when CLFS
resolved them (`OffsetToAddr` → the referenced structure) it accessed memory out of
bounds — improper input validation (CWE-20) of attacker-controlled log metadata,
exploitable for local elevation of privilege to SYSTEM (Microsoft rates exploitation
**More Likely**).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): create/open a crafted CLFS base log
  file.
- Set metadata offsets to reference locations outside the valid symbol zone.
- Result: CLFS resolves an out-of-range offset while parsing the log.

---

## Vulnerability Details

### Root Cause

The many self-referential offsets in the base-file control record / client & container
contexts were resolved without fully bounding them within the file's valid region, so
a malformed `.blf` produced out-of-bounds accesses.

### The patch (confirmed — diff, .1301 → .1455)

Gated behind `Feature_110180665` / `Feature_1868496191` / `Feature_2458037564`, CLFS
**adds/strengthens offset validation** across the base-file parsers — the
`Validate*Offsets` routines now bound each offset within the symbol zone and
cross-check the symbol length markers before `OffsetToAddr` resolves them:

```c
// CClfsBaseFile::ValidateClientContextOffsets (10.0.26100.1455) — PATCHED (from our diff)
while (idx < 0x7c) {
    off = *(uint *)(param_2 + idx*4 + 0x138);
    if (off - 1 < 0xfffffffe) {
        if (ValidateCheckifWithinSymbolZone(this, off + 0x87, param_2) < 0) goto reject;  // *** bound in symbol zone ***
        pv = OffsetToAddr(this, ...);
        if (pv == NULL) goto reject;
        if (*(int *)(pv - 0xc) != off || *(int *)(pv - 0x10) != *(int *)(pv - 0xc) + 0x88)  // *** cross-check length markers ***
            goto reject;
    }
    ...
}
```

The same in-symbol-zone bounds discipline is applied in
`ValidateContainerContextOffsets`, `ValidateOffsets`, `ValidateRgOffsets` and
`ValidateProcessQNode`, so a malformed `.blf` is rejected rather than parsed out of
bounds.

### Patch Completeness Assessment

**CFR-gated behind `Feature_110180665` / `Feature_1868496191` / `Feature_2458037564`.**
The strengthened validation runs only when the flags are enabled; the original
under-validating parser still ships when disabled. Verify the flags are enabled to
confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Opening/creating CLFS base log files (`.blf`) with offset/length
fields that reference outside the file's structures; OOB / pool-corruption bugchecks
in `clfs!CClfsBaseFile::OffsetToAddr` / `GetSymbol` / `Validate*Offsets` on
unpatched/flag-disabled builds. CLFS `.blf` abuse is a common local-EoP technique —
monitor untrusted `.blf` creation.

**Config.** The fix is CFR-gated — confirm the three flags are enabled.

---

## References

- MSRC advisory — CVE-2024-38196 (Windows Common Log File System Driver Elevation of Privilege), released 2024-08-13, KB5041571.
- Full binary diff: `/data/patch_diffs/clfs_sys-cve-2024-38196-ghidriff.md`