PT-2024-4174 · Microsoft · Windows Cloud Files Mini Filter Driver+1

Alex Birnberg + 4 · Published 2024-06-11 · Updated 2026-04-01 · CVE-2024-30085

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to June 2024 Patch Tuesday

Description The issue is a heap-based buffer overflow vulnerability affecting the Windows Cloud Files Mini Filter Driver (cldflt.sys). Successful exploitation allows an attacker to elevate privileges to the NT AUTHORITYSYSTEM level. The vulnerability exists due to improper handling of reparse points, potentially corrupting adjacent WNF STATE DATA objects and leaking kernel pointers via ALPC handle tables. Exploitation involves corrupting PipeAttribute objects to leak token addresses and override privileges. A proof-of-concept exploit is publicly available.

API Endpoints: Not specified Vulnerable Parameters or Variables: reparse point, WNF STATE DATA, PipeAttribute Function Names: Not specified

Recommendations Apply updates released during the June 2024 Patch Tuesday to address the vulnerability.

Exploit

Fix

LPE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-04659

CVE-2024-30085

ZDI-24-601

Affected Products

Windows

Windows Cloud Files Mini Filter Driver

References · 51

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2024_30085_cloud_files.rb · Exploit
• 🔥 https://github.com/Adamkadaban/CVE-2024-30085 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-30085 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30085 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30085 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-601 · Security Note
• https://bdu.fstec.ru/vul/2024-04659 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30085 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085 · Vendor Advisory
• https://twitter.com/moton/status/1871555212659572929 · Twitter Post
• https://twitter.com/ale_sp_brazil/status/2029237105088463269 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2039071106431176780 · Twitter Post
• https://twitter.com/TechBuzzRecap/status/1871531513864446447 · Twitter Post
• https://twitter.com/hackyboiz/status/1878019268266410316 · Twitter Post
• https://twitter.com/leonov_av/status/1909204924937666630 · Twitter Post