# CVE-2022-24521: Windows Common Log File System (CLFS) Logical-Error Vulnerability

CLFS encode/decode restores a zeroed pContainer field in the container context, letting a crafted base log record pass an attacker pointer to an indirect call in RemoveContainer for kernel RIP control.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: National Security Agency, Adam Podlosky and Amir Bazine of Crowdstrike
- Disclosed: 2022-04-12
- CVE: CVE-2022-24521
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-24521.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-24521
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:reverse-engineering technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** clfs.sys CLFS base log file / container context handling
**Root cause:** ClfsEncodeBlock/ClfsDecodeBlock round-trip restores bytes of the container context (including the zeroed pContainer) from the signature array, so the pre-call NULL-ing of pContainer is undone before RemoveContainer's indirect call.
**Steps:**
1. Craft base log record so container context and signature array (SignaturesOffset) are adjacent, so encode/decode restores context bytes without corruption.
2. Set container context field at +5 (offset 0x14) to -1 to trigger CClfsBaseFilePersisted::RemoveContainer from LoadContainerQ.
3. Ensure CClfsBaseFile::AcquireContainerContext fails at Stage [3] so the restored pContainer is not overwritten back to zero.
4. Encode block (Stage [1]) writes SIG_* bytes back, restoring attacker-controlled pContainer; decode (Stage [2]) then Stage [3] skips update.
5. RemoveContainer reads pContainer and calls `(*(pContainer+0x18))(pContainer)` then `(*(pContainer+8))(pContainer)` -> RIP control.
**How found:** Analysis of CLFS format: noticed signature array intersects container/client context, so encode/decode restores modified bytes. Hypothesized zeroing pContainer in memory, traced its use to RemoveContainer's indirect call, and found the encode/decode round-trip undoes the NULL-ing.
**Exploitation:** Attacker crafts a malicious .blf base log file. Exploit flow: create pipe objects with attributes (PipeAttribute in Paged Pool), leak kernel addresses via NtQuerySystemInformation, allocate fake_pipe_attribute, obtain gadget module base via NtQuerySystemInformation, trigger CLFS bug to call a gadget giving arbitrary read to find EPROCESS, then trigger again to overwrite process token for SYSTEM.
**Escalation:** Chained arbitrary read (EPROCESS discovery) with a second trigger to overwrite the process token, escalating from kernel RIP control to SYSTEM privileges.
**Insight:** When a format has overlapping regions (signature array vs context), check whether serialize/deserialize round-trips silently restore security-critical fields that code just zeroed; look for indirect calls guarded only by a NULL check on a field that a decode step can repopulate.