# CVE-2024-49114 — Windows Cloud Files Mini Filter `cldflt.sys` Missing Synchronization in `HsmFltProcessConvertPlaceholder`

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver; on-demand files) |
| **CVE ID** | CVE-2024-49114 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-820: Missing Synchronization |
| **Delivery** | Local — concurrent placeholder-convert / stream operations |
| **KB / Fixed build** | KB5048667 — `cldflt.sys` 10.0.26100.2605 (Win11 24H2 x64) |
| **Patch Date** | December 10, 2024 (2024-Dec) |
| **Pre-patch binary** | `cldflt.sys` 10.0.26100.2161 — SHA256 `8a0f90cdc2a689444f02140400a7c62a764ebd989ad30ebc381ecec2ba896537` |
| **Post-patch binary** | `cldflt.sys` 10.0.26100.2605 — SHA256 `8ed9e56cb114e8135466518336e5f6c179ead70ed7b41dc3fd8cace632e3f9ef` |
| **Feature flag** | `Feature_401191227` / `Feature_3260711228` — **CFR-gated** |
| **Exploitability** | Exploitation **More Likely**; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`cldflt.sys` is the Cloud Files Mini Filter (kernel side of OneDrive / cloud
on-demand files). It converts files to/from **placeholders** and processes
**extended-attribute (EA)** operations against a per-stream context.
`HsmFltProcessConvertPlaceholder` performs the placeholder conversion;
`HsmFltPreSET_EA` / `QueryIfEAExists` handle EA operations on the same stream.

---

## Vulnerability Summary

Pre-patch, `HsmFltProcessConvertPlaceholder` performed the placeholder conversion
**without synchronizing against concurrent sync operations** on the same stream, and
the EA path (`HsmFltPreSET_EA` / `QueryIfEAExists`) likewise accessed stream state
without coordinating with it. A concurrent operation could therefore modify the
placeholder/stream state mid-conversion — a missing-synchronization defect (CWE-820)
that corrupts stream/placeholder state. Because `cldflt` runs in the kernel and the
operations are reachable by a local user, the resulting corruption is exploitable
for local elevation of privilege to SYSTEM (per the MSRC FAQ; Microsoft rates
exploitation **More Likely**).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): drive Cloud Files placeholder
  conversion while issuing concurrent stream/EA operations on the same file.
- Result: the placeholder/stream state is modified during the unsynchronized
  conversion.

---

## Vulnerability Details

### Root Cause

The placeholder conversion did not hold synchronization against other sync operations
on the same stream context, so concurrent operations could mutate the state the
conversion was working on.

### The patch (confirmed — diff, .2161 → .2605)

Gated behind `Feature_401191227` / `Feature_3260711228`,
`HsmFltProcessConvertPlaceholder` now fetches the stream context and takes **sync-op
rundown protection** around the conversion, and the EA preop acquires the stream
context before operating:

```c
// HsmFltProcessConvertPlaceholder (10.0.26100.2605) — PATCHED (from our diff)
if (Feature_401191227__private_IsEnabledDeviceUsageNoInline()) {
    streamCtx = HsmpGetStreamContext(fltObjects, fileObject, &ctx);
    status    = HsmpAcquireSyncOpRundownProtection(streamCtx, fltObjects);  // *** serialize convert ***
    ... perform placeholder conversion ...
    HsmpReleaseSyncOpRundownProtection(streamCtx);
    FltReleaseContext(streamCtx);
}

// HsmFltPreSET_EA — HsmpGetStreamHandleContext(...) taken before SET_EA processing
```

By holding sync-op rundown protection on the stream context across the conversion (and
acquiring the stream/handle context in the EA path), concurrent operations can no
longer mutate the placeholder/stream state mid-convert, closing the
missing-synchronization window.

### Patch Completeness Assessment

**CFR-gated behind `Feature_401191227` / `Feature_3260711228`.** The synchronization
runs only when the flags are enabled; the original unsynchronized path still ships
when disabled. Verify the flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Concurrent Cloud Files placeholder conversions and EA/sync
operations on the same file/stream; corruption / bugchecks in
`cldflt!HsmFltProcessConvertPlaceholder` / `HsmFltPreSET_EA` on
unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_401191227` /
`Feature_3260711228` are enabled.

---

## References

- MSRC advisory — CVE-2024-49114 (Windows Cloud Files Mini Filter Driver Elevation of Privilege), released 2024-12-10, KB5048667.
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2024-49114-ghidriff.md`