PT-2022-2241 · Microsoft · Windows Common Log File System Driver+1

Adam Podlosky + 1 · Published 2022-04-12 · Updated 2025-12-09 · CVE-2022-24521

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver (affected versions not specified)

Description This issue is an elevation-of-privilege vulnerability affecting the Windows Common Log File System Driver. Successful exploitation could allow attackers to affect the system and potentially gain elevated privileges. The Vanilla Tempest cybercrime gang has been observed using this vulnerability in conjunction with INC ransomware. The vulnerability is related to errors in privilege management within the driver. It was reported by CrowdStrike and the NSA. Multiple sources indicate the vulnerability is being actively exploited by ransomware operators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Memory Corruption

Weakness Enumeration

CWE-787

CWE-264

Related Identifiers

BDU:2022-02337

CVE-2022-24521

Affected Products

Windows

Windows Common Log File System Driver

References · 50

• https://nvd.nist.gov/vuln/detail/CVE-2022-24521 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24521 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-24521 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24521 · Security Note
• https://bdu.fstec.ru/vul/2022-02337 · Security Note
• https://github.com/Wh04m1001/ZoneAlarmLPE · Note
• https://t.me/true_secator/5243 · Telegram Post
• https://twitter.com/PhillipRey54054/status/1938543590398918662 · Twitter Post
• https://t.me/cvenotify/112285 · Telegram Post
• https://t.me/cvenotify/29046 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24521 · Note
• https://t.me/cvenotify/29032 · Telegram Post
• https://t.me/aptreports/1921 · Telegram Post
• https://t.me/true_secator/2844 · Telegram Post