# CVE-2023-28252: Windows Common Log File System Driver Elevation of Privilege Vulnerability

Malformed CLFS BLF file with iExtendBlock/iFlushBlock=0x13 causes OOB read and one-byte increment in clfs.sys, exploited in the wild for SYSTEM privilege escalation.

- Payout: Real-world hack
- Severity: high
- Program: Windows
- Credited: Genwei Jiang, FLARE OTF
- Disclosed: 2023-04-11
- CVE: CVE-2023-28252
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2023/CVE-2023-28252.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2023-28252
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained vuln:dos vuln:memory-corruption vuln:privilege-escalation

**Target:** Windows kernel CLFS driver (clfs.sys) BLF log file parsing
**Root cause:** CClfsBaseFilePersisted::ExtendMetadataBlock and WriteMetadataBlock trust ControlRecordShadow.iExtendBlock/iFlushBlock (0x13) without bounds validation, causing OOB read and a one-byte increment of rgContainers[0] in a sprayed BLF object.
**Steps:**
1. Craft BLF file: `WriteFileAt(blf,0x484,0x2,4)` eExtendState=FlushingBlock; `0x488,0x13,2` iExtendBlock; `0x48a,0x13,2` iFlushBlock; `0x84,0x2,4`; `0x88,0x4,2`; `0x8a,0x4,2`; `0x90,0x1,4` cExtendStartSectors=1; `0x94,0x3,4` cExtendSectors=3; `0x9c,0x2,4` cClients=2; `0x70,0x2,4` ullDumpCount=2; `0x6,0x1,2` ValidSectorCount=1
2. Leak SYSTEM and current process kernel addresses via `NtQuerySystemInformation`
3. Prepare CONTAINER_CONTEXT at offset 0x1470 and fake CONTAINER_CONTEXT at 0x1570 in target BLF
4. Create 10 triggering BLF files with malformed fields
5. Spray pool via Pipe objects filled with targeted BLF file object data
6. Close specific Pipe handles to create holes; refill with `CreateLogFile` on triggering BLF
7. Place gadget table at user address `0x5000000`
8. Call `AddLogContainer` on triggering BLF handle to trigger OOB and one-byte increment of rgContainers[0]
9. Call `CreateLogFile` on targeted BLF to detonate fake vftable at 0x5000000
**How found:** Text states ITW exploitation strategies and code flows are close to CVE-2023-23376 and likely found through variant analysis; no first-person discovery trail given.
**Exploitation:** ITW exploit leaks kernel addresses, sprays Pipe pool with BLF objects, creates holes, refills with CreateLogFile, places fake vftable/gadgets at 0x5000000, triggers OOB via AddLogContainer to increment rgContainers[0] so it points to a fake CONTAINER_CONTEXT whose vftable is 0x5000000, then detonates via CreateLogFile. Win10 gadgets overwrite PreviousMode to KernelMode enabling ARW via NtWriteVirtualMemory; Win11 gadgets corrupt pipe attributes enabling ARW via NtFsControlFile. Both overwrite current process Token with leaked SYSTEM token.
**Escalation:** OOB read + one-byte increment converted to type confusion via fake CONTAINER_CONTEXT vftable at user-controlled 0x5000000, yielding arbitrary kernel read/write then token theft for SYSTEM.
**Insight:** CLFS BLF ControlRecordShadow fields (iExtendBlock/iFlushBlock) are attacker-controlled and drive array indexing in ExtendMetadataBlock/WriteMetadataBlock; a single-byte increment of rgContainers[0] is enough to pivot a sprayed object to a fake CONTAINER_CONTEXT, so look for one-byte/partial-write primitives in log-file parsers that can be paired with pool spray.