Very High
CVE-2022-37969
Very High
(1 user assessed)
Very High
(1 user assessed)Unknown
Unknown
Unknown
CVE-2022-37969
Description
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Add Assessment
Technical Analysis
The vulnerability arises due to insufficient input validation in the CLFS driver. Specifically, CLFS mishandles certain crafted input, allowing an attacker to manipulate memory and execute code with elevated privileges.
Exploitation requires local access to the system. An attacker can:
Craft Malicious Input: Create a malformed CLFS log file or log-related operation that triggers the vulnerability in the driver. Abuse Kernel Privileges: Exploit the vulnerability to execute arbitrary code in kernel mode. Escalate Privileges: Gain SYSTEM privileges, enabling complete control over the affected system.
This vulnerability is particularly useful for attackers as a post-exploitation mechanism, allowing them to escalate privileges after gaining initial access to a target system.
Exploitation in the Wild
CVE-2022-37969 has been actively exploited in targeted attacks. Threat actors, including advanced persistent threat (APT) groups, have leveraged this vulnerability as part of multi-stage attack campaigns.
CISA released an updated advisory on the BianLian ransomware group including the vulnerabilities the group is using to gain initial access towards victims.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 20h2,
- windows 10 21h1,
- windows 10 21h2,
- windows 11 21h2,
- windows 7 -,
- windows 8.1 -,
- windows rt 8.1 -,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016,
- windows server 2019,
- windows server 2022
Exploited in the Wild
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
