CVE-2024-30085

Published Jun 11, 2024

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-30085 is an elevation of privilege vulnerability found within the Windows Cloud Files Mini Filter Driver (cldflt.sys), a kernel-level component responsible for managing cloud file synchronization operations in Windows, particularly for services like OneDrive. The flaw is a heap-based buffer overflow (CWE-122) that occurs because the driver improperly validates the size of user-supplied data before copying it into a fixed-size buffer when processing reparse points. This vulnerability allows a local attacker with low-level privileges to exploit the system. By crafting a malicious application or script that interacts with the cldflt.sys driver, an attacker can trigger the buffer overflow, corrupting kernel heap memory. Successful exploitation can lead to privilege escalation, granting the attacker SYSTEM-level access and potentially full control over the affected machine.

Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Source: secure@microsoft.com
NVD status: Modified
Products: windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_11_23h2, windows_server_2019, windows_server_2022, windows_server_2022_23h2

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-122
nvd@nist.gov: NVD-CWE-noinfo

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9B52F95E-6080-46C6-B4B6-E2B3F3E78456",
            "versionEndExcluding": "10.0.17763.5936",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1CEAF689-E8DB-4D3C-BC2E-B386BC077BC5",
            "versionEndExcluding": "10.0.19044.4529",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "970F54FC-F4ED-49B9-BE94-96B7212FD149",
            "versionEndExcluding": "10.0.19045.4529",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "84ECD6C0-8C47-4D2F-82B5-4F8C0BBC5FEE",
            "versionEndExcluding": "10.0.22000.3019",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4E80DF17-1F27-474E-B147-9F5B6C494300",
            "versionEndExcluding": "10.0.22621.3737",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4258468C-56CC-45C0-B510-FC833E942876",
            "versionEndExcluding": "10.0.22631.3737",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "12F9D974-A968-4CBB-81D8-C73B76DD284A",
            "versionEndExcluding": "10.0.17763.5936",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "498A643B-0180-4AD3-BD7C-5E3CEB0FD112",
            "versionEndExcluding": "10.0.20348.2522",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0EA59E2D-57B2-4E8B-937A-3EB51A3AD285",
            "versionEndExcluding": "10.0.25398.950",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.