# CVE-2024-38215 — Windows Cloud Files Mini Filter `cldflt.sys` Integer Overflow in the Hydration-Restart / Placeholder-Create Path

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver; on-demand files) |
| **CVE ID** | CVE-2024-38215 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-190: Integer Overflow or Wraparound |
| **Delivery** | Local — a crafted Cloud Files provider port message |
| **KB / Fixed build** | KB5041571 — `cldflt.sys` 10.0.26100.1455 (Win11 24H2 x64) |
| **Patch Date** | August 13, 2024 (2024-Aug) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.1301 — SHA256 `828bf27aff3ea99b6ece4afe1bbbe5ee65c324e203ab1dcc301cb7c5dd6f5313` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.1455 — SHA256 `26457170162d32f5e1d752af1b80bae05dd0137a4154e09d2b8311e7afda4641` |
| **Feature flag** | `Feature_2175866168` / `Feature_1314816318` — **CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Sourcing note: the OS fixed build is `.1457`; the `cldflt.sys` binary shipped in
> KB5041571 is versioned `.1455` (driver version trails the OS build). Pre = `.1301`.

---

## Product Description

`cldflt.sys` is the Cloud Files Mini Filter (kernel side of OneDrive / cloud
on-demand files). It exchanges messages with the user-mode Cloud Files provider over
its communication port. `CldiPortProcessRestartHydration` parses offset/count fields
from a provider message (to resume file hydration), and `HsmpOpCreatePlaceholders`
builds placeholder buffers from user-supplied input.

---

## Vulnerability Summary

Pre-patch, the offset/count fields carried in the provider message were used to size
and index kernel buffers **without overflow checks**. A crafted message could set an
offset+count so their sum **wraps** (integer overflow, CWE-190), producing an
under-sized or mis-indexed access when the driver processed the hydration-restart or
placeholder-creation request. Because `cldflt` runs in the kernel and the port is
reachable by a local user, the resulting out-of-bounds access is a local
elevation-of-privilege primitive to SYSTEM (per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): send a crafted message to the
  Cloud Files communication port (or drive the provider path).
- Set offset/count fields so `offset + count` wraps or `count` exceeds the buffer.
- Result: an integer overflow drives OOB access in the kernel minifilter.

---

## Vulnerability Details

### Root Cause

Message-supplied offset/count values were used in size/index arithmetic without
validating for wraparound or against the buffer bounds.

### The patch (confirmed — diff, .1301 → .1455)

Gated behind `Feature_2175866168` / `Feature_1314816318`,
`CldiPortProcessRestartHydration` adds lower-bound, wrap-detection and upper-bound
checks on the message offset/count fields, and `HsmpOpCreatePlaceholders` probes the
user buffer and uses a bounded allocation:

```c
// CldiPortProcessRestartHydration (10.0.26100.1455) — PATCHED (from our diff)
// require offset fields >= header + entry_count*8 + 0x10, and detect wraps:
if ( count != 0 &&
     (count < (uint)entry_count * 8 + 0x10 || total < count) )          reject;
uVar1 = base + count;
if ( uVar1 < count || total < uVar1 )                                   reject;  // *** wrap + upper bound ***

// HsmpOpCreatePlaceholders (10.0.26100.1455) — PATCHED:
mdl = IoAllocateMdl(userBuf, userLen, 0, 0);
ProbeForRead(userBuf, userLen);                 // validate the user buffer
p = ExAllocatePool2(0x100, 0x4000, 'RsHt');     // bounded allocation
```

With wrap-detection (`base + count < count`) and upper-bound checks on the
message-supplied offsets (and probing of the user buffer), the overflow can no longer
occur.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2175866168` / `Feature_1314816318`.** The checks run only
when the flags are enabled; the original unchecked path still ships when disabled.
Verify the flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Cloud Files provider port messages with offset/count fields near
`UINT` boundaries; OOB / pool-corruption bugchecks in
`cldflt!CldiPortProcessRestartHydration` / `HsmpOpCreatePlaceholders` on
unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_2175866168` /
`Feature_1314816318` are enabled.

---

## References

- MSRC advisory — CVE-2024-38215 (Windows Cloud Files Mini Filter Driver Elevation of Privilege), released 2024-08-13, KB5041571.
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2024-38215-ghidriff.md`