Windows CLFS Driver Heap-Based Buffer Overflow Elevation of Privilege Vulnerability (CVE-2024-49138) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-49138) is a heap-based buffer overflow (CWE-122) residing in the Common Log File System (CLFS.sys) driver, a core kernel component of the Windows operating system. The root cause lies in the driver's improper validation of input metadata structures when parsing Base Log Files (.blf). By supplying a maliciously crafted .blf file, an attacker triggers an out-of-bounds write within the kernel pool memory.

2. Exploitation Mechanics & Attack Scenario

An attacker who has already established local access with low-privilege user rights can execute this exploit.

• The attacker constructs a corrupted .blf file with manipulated control block headers and size fields.
• The attacker invokes the CreateLogFile API to force the CLFS driver to load and parse the malformed file.
• During parsing, the driver allocates insufficient memory based on the corrupted metadata, leading to a heap overflow in the kernel pool.
• This corruption allows the attacker to overwrite adjacent kernel objects or function pointers, hijacking the kernel execution flow to run arbitrary payloads with SYSTEM privileges.

3. Infrastructure & Business Impact

As this vulnerability is actively exploited in the wild and listed in CISA's KEV catalog, it poses an immediate threat to enterprise environments. Local Privilege Escalation (EoP) vulnerabilities are critical components of multi-stage cyber attacks, often paired with initial access vectors to perform lateral movement, bypass endpoint detection (EDR), and compromise Active Directory Domain Controllers.