# The Immutable Illusion: Pwning Your Kernel with Cloud Files

CloudFiles driver cldflt.sys uses FltWriteFileEx with paging I/O and IO_IGNORE_SHARE_ACCESS_CHECK to overwrite 'immutable' image-mapped DLLs, enabling a kernel/PPL exploit without SMB.

- Payout: Research
- Severity: high
- Program: Windows CloudFiles
- Credited: Gabriel Landau
- Disclosed: 2026-02-20
- Write-up quality: 9/10
- Original: https://www.elastic.co/security-labs/threat-command/immutable-illusion
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion
- Tags: domain:desktop impact:integrity impact:privesc kind:research platform:threat-intel sev:high tech:windows technique:reverse-engineering technique:source-review vuln:access-control vuln:misconfiguration vuln:privilege-escalation

**Target:** cldflt.sys CloudFiles minifilter driver / Windows kernel file immutability
**Root cause:** cldflt.sys opens files with only FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE plus IO_IGNORE_SHARE_ACCESS_CHECK, then writes via FltWriteFileEx with FLTFL_IO_OPERATION_PAGING|SYNCHRONOUS_PAGING, bypassing both the FILE_WRITE_DATA-based MmFlushImageSection check and the file access model.
**Steps:**
1. Map target DLL as SEC_IMAGE via ZwCreateSection(SEC_IMAGE)+ZwMapViewOfSection, then close file/section handles (mimics LoadLibrary).
2. Open the same file with `FltCreateFileEx2` requesting only `SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES` and `IO_IGNORE_SHARE_ACCESS_CHECK`.
3. Call `FltWriteFileEx(instance, fileObject, &offset, len, buf, FLTFL_IO_OPERATION_PAGING|FLTFL_IO_OPERATION_SYNCHRONOUS_PAGING, ...)` to write payload despite no FILE_WRITE_DATA.
4. For PPLFault variant: register CloudFiles provider, serve original DLL via CfExecute for CI signature check, then second CfExecute to overwrite with payload.
**How found:** Prior FFI research on SMB redirectors; Process Monitor at altitude 180450 below cldflt revealed a write to an image-mapped DLL opened only for attributes. Kernel debugger breakpoint on FltWriteFileEx showed cldflt!HsmiRecallWriteFileNoLock calling it with a FILE_OBJECT lacking WriteAccess but with 'Ignore share access checks' flag and paging flags, prompting driver experiments to reproduce.
**Exploitation:** Attacker registers a CloudFiles sync provider and creates a placeholder DLL. Victim (e.g. services.exe) loads it; CI fetches original for signature verification via CfExecute rehydration callback, then attacker issues a second CfExecute to overwrite the file with malicious payload. cldflt.sys writes via paging I/O bypassing MmFlushImageSection, achieving code injection into a PPL process without SMB.
**Escalation:** Chains FFI bypass into PPL process code injection (PPLFault-style), bypassing Microsoft's network-redirector-specific mitigation; remains unpatched on some fully-patched Windows versions (forever-day).
**Insight:** Minifilter drivers using FltWriteFileEx with FLTFL_IO_OPERATION_PAGING can write to FILE_OBJECTs opened without FILE_WRITE_DATA, sidestepping MmFlushImageSection; audit any kernel component that opens files with attribute-only access then writes via paging I/O, especially cloud/sync providers.