# CVE-2025-55336 — Windows Cloud Files Mini Filter Driver `cldflt.sys` Uninitialized Query-Progress Output → Kernel Address Disclosure

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cldflt.sys` (Cloud Files Mini Filter Driver) |
| **CVE ID** | CVE-2025-55336 |
| **Impact** | Information Disclosure (kernel memory-address leak) |
| **MSRC severity** | Important |
| **CVSS** | 5.5 / 4.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C` |
| **CWE** | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
| **Delivery** | Local — query the cloud-files stream progress and read the returned buffer |
| **KB / Fixed build (diffed lineage, 23H2)** | KB5066793 — `cldflt.sys` 10.0.22621.6060 (Win11 23H2 x64; OS build 22631.6060) |
| **Patch Date** | October 14, 2025 (2025-Oct) |
| **Pre-patch binary** | `cldflt.sys` 10.0.22621.5766 (KB5065431) — SHA256 `5ca81ccdc02f6c28aa3ae062f7ed66aaa54bbb495a5fbdd69d238bd39d1ce651` |
| **Post-patch binary** | `cldflt.sys` 10.0.22621.6060 (KB5066793) — SHA256 `1778936231f1be7f64ec6196c4822de64c71e9c01b5081c6a0fb266c07c64adc` |
| **Feature flag** | `Feature_899985722` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Companion: the same October Cloud Files update also fixes **CVE-2025-55680**
> (separately diffed). This RCA covers the CWE-200 kernel-address disclosure.
>
> Sourcing note: the Microsoft symbol-server coordinates for this file
> (`B5371DB0…` / `F5F18A33…`) are **ambiguous** — the same TimeDateStamp+size collides
> with other cldflt builds (`.5983` / `.1488`), so a coord-based re-download may return
> the wrong file. The authoritative Sept→Oct pair (by winbindex SHA) is `.5766 → .6060`
> (KB5065431 → KB5066793); the version strings embedded in the raw ghidriff report are
> cosmetically affected by that collision. The diff is small and adjacent (5 code
> changes), consistent with the single monthly fix.

---

## Product Description

`cldflt.sys` is the **Cloud Files Mini Filter Driver** backing the Cloud Files API
(OneDrive / cloud-backed placeholders). `CldStreamQueryProgress` services a
user-issued query for the progress of a cloud-file stream operation and writes an
array of fixed-size progress records back into a user-supplied output buffer (after
`ProbeForWrite`).

---

## Vulnerability Summary

Pre-patch, `CldStreamQueryProgress` populated the progress records it copied to the
caller's output buffer **without fully initializing every field**, so residual kernel
stack/pool contents — including a **kernel memory address** — were left in the output
and exposed to the caller (CWE-200). Per the MSRC FAQ, the disclosed data is "a memory
address within kernel space", which defeats kernel ASLR and can aid a follow-on
exploit. The leak is read by a local, low-privileged caller (`AV:L`, `PR:L`, `C:H`,
`I:N`, `A:N` — confidentiality only).

> Confirmation level: the October `cldflt.sys` update changes several stream/placeholder
> functions under `Feature_899985722` / `Feature_29931835`. The isolable
> information-disclosure mechanism is the **initialization/sanitization of the
> `CldStreamQueryProgress` output records** before they are copied to the user buffer
> (the function grew 5255→5527 bytes and gains additional zeroing under
> `Feature_899985722`); stated at confirmed-changed level.

---

## Prerequisites and Constraints

- Local, low-privileged (`AV:L`, `AC:L`, `PR:L`): issue the cloud-files stream
  progress query and read the returned output buffer.
- Result (pre-patch): the returned progress records contain uninitialized kernel
  memory, including a kernel address.

---

## Vulnerability Details

### Root Cause

The progress records written to the user output buffer were not fully zero-initialized,
so uninitialized kernel memory (including a kernel pointer/address) was copied out to
the caller.

### The patch (confirmed — diff, .5766 → .6060)

Gated behind `Feature_899985722`, `CldStreamQueryProgress` adds initialization /
sanitization of the per-record output before the copy to the user buffer (function
length 5255 → 5527 bytes):

```c
// CldStreamQueryProgress (10.0.22621.6060) — PATCHED (from the diff)
// output records are written to the user buffer after ProbeForWrite(param_2, count, 1);
// the patched path zero-initializes the record buffer (added memset/zeroing of the
// 0x40/0x90-byte record area) so no uninitialized kernel memory — including a kernel
// address — remains in the fields copied out to the caller.
*param_4 = record_count;
if (param_3 < record_count) { /* buffer too small */ }
ProbeForWrite(param_2, record_count, 1);
// ... zeroed/sanitized records written to param_2 ...
```

By zero-initializing the progress records before copyout, the driver no longer exposes
residual kernel memory (or a kernel address) to the caller, closing the disclosure.

### Patch Completeness Assessment

**CFR-gated behind `Feature_899985722`.** The added output initialization runs only
when the flag is enabled; the original path still ships when disabled. Verify the flag
is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** This is a pure information disclosure — it does not crash. Hunt for
processes issuing high volumes of Cloud Files stream-progress queries and inspecting
returned buffers on unpatched/flag-disabled builds. Low individual signal; treat as
part of a KASLR-defeat / exploit chain.

**Config.** The fix is CFR-gated — confirm `Feature_899985722` is enabled.

---

## References

- MSRC advisory — CVE-2025-55336 (Windows Cloud Files Mini Filter Driver Information Disclosure), released 2025-10-14, KB5066793 (23H2).
- Full binary diff: `/data/patch_diffs/cldflt_sys-cve-2025-55336-ghidriff.md`