# RCA — CVE-2025-21315 (bfs.sys PolicyTable missing-lock UAF race)

- **Binary:** `bfs.sys` (Brokering File System minifilter)
- **Patch:** KB5050009 (Jan 2025), `10.0.26100.2454` → `10.0.26100.2894`
- **Class:** CWE-416 use-after-free (race) | **Impact:** EoP | **ITW:** no
- **Primary source:** [HT3Labs](https://ht3labs.com/Brokering-File-System-January-2025-Patch-Analysis.html)
- **Diff:** `ghidriff/CVE-2025-21315/output/bfs-10.0.26100.2454.sys-bfs-10.0.26100.2894.sys.ghidriff.md` (shared with CVE-2025-21372)

## Root cause

Several policy-management code paths accessed the global `PolicyTable`
(`{ PushLock, RTL_DYNAMIC_HASH_TABLE, LIST_ENTRY, Timer }`) and `PolicyEntry`
objects **without holding the table lock**, so concurrent policy add / remove /
query / idle-cleanup could free or re-link a `PolicyEntry` while another thread
was still using it → UAF.

## Patch

Gated by `Feature_2880249144`, the update adds the missing lock placements across
the policy paths and introduces `BfsDereferencePolicyEntryEx` to centralize safe
entry release. ~15 functions touched; key ones:

- Added: `BfsDereferencePolicyEntryEx`, `Feature_2880249144__private_IsEnabled*`
- Modified: `BfsRemovePolicyEntry`, `BfsInsertPolicyEntry`, `BfsGetPolicyEntry`,
  `BfsCheckAndReleaseIdlePolicy`, `BfsUninitializePolicyTable`,
  `BfsProcessSetPolicyRequest`, `BfsProcessQueryPolicyRequest`,
  `BfsCheckAndApplyPolicy`, `BfsPostCreateOperation`, `BfsPerformPrompt`, others

Confirmed in the ghidriff diff (`BfsDereferencePolicyEntry` old ↔
`BfsDereferencePolicyEntryEx` new, 81% match).

## Attribution vs CVE-2025-21372 (same binary, same month)

| CVE | Gate | Path | Anchor function |
|---|---|---|---|
| CVE-2025-21372 | `Feature_752421176` | named pipes | `BfsReleaseNamedPipeMapping` (only xref of the gate) |
| CVE-2025-21315 | `Feature_2880249144` | policy table | `BfsDereferencePolicyEntryEx` + ~15 policy-path funcs |

## Reaching the bug

Concurrent BFS policy operations from an AppContainer/AppSilo process — e.g.
policy add/remove requests racing the idle-entry cleanup timer
(`BfsCheckAndReleaseIdlePolicy`) or query requests. See the CVE-2025-29970 RCA
for the BFS IOCTL surface (`\\?\GLOBALROOT\Device\Bfs`, AppSilo token).

## Detection notes

- Crash signature: access violation in bfs policy paths
  (`BfsRemovePolicyEntry` / `BfsGetPolicyEntry` / idle cleanup).
- Same named-pipe/AppContainer telemetry as CVE-2025-21372 applies.