OnlyPatch
Windows Cloud Files Mini Filter Driver

CVE-2024-38215 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00681 🔬 Patch diffed 2024-08 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-190: Integer Overflow or Wraparound
Released Aug 13 2024
Last Updated Aug 13 2024
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00681 — 0.49295 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00681
probability of exploitation in the next 30 days
0.49295 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

21 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1809 for 32-bit Systems 5041578 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5041578 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5041580 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5041592 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5041592 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5041585 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5041585 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5041585 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5041585 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5041571 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5041571 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5041578 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5041578 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5041160 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5041160 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5041573 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5041578 Security Update Yes
5041580 Security Update Yes
5041592 Security Update Yes
5041585 Security Update Yes
5041571 Security Update Yes
5041160 Security Update Yes
5041573 Security Update Yes

Patch Diff

ghidriff · cldflt.sys (KB5041571)

Integer overflow (CWE-190) in the Windows Cloud Files minifilter cldflt.sys hydration-restart / placeholder-create path, local EoP to SYSTEM. cldflt.sys processes messages from the user-mode Cloud Files provider over its communication port; CldiPortProcessRestartHydration parses offset/count fields out of the provider message, and HsmpOpCreatePlaceholders builds placeholder buffers from user input. PRE: the offset/count fields were used to size/index buffers without overflow checks, so a crafted message could wrap an offset+count computation (integer overflow) and drive out-of-bounds access in the kernel minifilter. Diff of cldflt.sys 10.0.26100.1301 -> .1455 (Aug 13 2024, KB5041571) confirms the fix: gated behind CFR flags Feature_2175866168 / Feature_1314816318, CldiPortProcessRestartHydration adds bounds and wrap-detection checks on the message offset/count fields (e.g. requiring count offsets to be >= header size + entry_count*8+0x10, and detecting sum wraps via 'uVar1 = base + count; if (uVar1 < count) reject', plus 'uVar2 < uVar1' upper bounds), and HsmpOpCreatePlaceholders is hardened (IoAllocateMdl + ProbeForRead around the user buffer, bounded ExAllocatePool2) so the overflow can no longer occur.

Pre-patch version 10.0.26100.1301 Download
Post-patch version 10.0.26100.1455 Download
Function Address Change Note
CldiPortProcessRestartHydration code change code (offset/count overflow + bounds checks added, CFR-gated) Post (Feature_2175866168): validates the provider-message offset/count fields - lower bounds (>= entry_count*8+0x10), sum-wrap detection (base+count < count -> reject) and upper bounds (total <= buffer) before use.
HsmpOpCreatePlaceholders code change code (user-buffer probing/bounded alloc) Post: IoAllocateMdl(param_4,param_5) + ProbeForRead(param_4,param_5) around the user buffer and bounded ExAllocatePool2(0x4000) - hardening the placeholder-creation input handling.
HsmFltProcessConvertPlaceholder / HsmFltProcessUpdatePlaceholder / CldiPortProcessAckNotification code change code (related placeholder/port paths updated) Updated alongside under the same gate.
Feature_2175866168 / Feature_1314816318 gate added (CFR gate) CFR flags gating the overflow/bounds validation; the original unchecked path still ships when disabled.
View full diff report View RCA report

Attack Path

A crafted Cloud Files provider message wraps an offset+count computation, driving OOB access

Attack path for CVE-2024-38215 A crafted Cloud Files provider message wraps an offset+count computation, driving OOB access 01 — ENTRY Local user (or a controlled provider) sends a Cloud Files port message cldflt.sys CldiPortProcessRestartHydration / HsmpOpCreatePlaceholders parse offset/count fields from the message. AV:L/PR:L/AC:L. 02 — CONTROLLED INPUT Supplies offset/count fields chosen to overflow offset + count is set so the 32-bit sum wraps, or count exceeds the buffer. 03 — MISSING CHECK Offset/count used to size/index without overflow checks (CWE-190) The wrapped computation yields an under-sized/mis-indexed access in the kernel minifilter. 04 — PATH Out-of-bounds access on the kernel buffer The overflow drives OOB read/write during hydration-restart / placeholder creation. 05 — PRIMITIVE Integer overflow -> OOB -> EoP to SYSTEM The Aug 2024 fix (Feature_2175866168) adds wrap-detection + bounds checks and probes the user buffer.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

Ezrakiez with MatrixCup

On This Page