Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8611 | Local Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild | 7.8 | 4% | KEV | KEV |
| CVE-2021-31955 | Windows Kernel Information Disclosure Vulnerability Actively Exploited (CVE-2021-31955) | 5.5 | 81% | KEV | KEV |
| CVE-2022-24521 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 7% | KEVRansomware | KEV |
| CVE-2023-23376 | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 11% | KEVRansomware | KEV |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation | 7.8 | 49% | KEVRansomwarePoC | KEV |
From the original article
6 min read at securelist.com
This is the second part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you haven’t already. You can skip to the other parts using this table of contents or using the link at the end of this part.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.