cbcvebase.
CVE-2022-24521
published 2022-04-15

CVE-2022-24521: Windows Common Log File System Driver Elevation of Privilege Vulnerability

PriorityP186high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-05-04
Exploited in the wild
EPSS
7.30%
93.7th percentile
Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected

51 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.1926510.0.10240.19265
microsoftwindows_10_1607< 10.0.14393.506610.0.14393.5066
microsoftwindows_10_1809<= 10.0.17763.2803
microsoftwindows_10_1909< 10.0.18363.221210.0.18363.2212
microsoftwindows_10_20h2< 10.0.19042.164510.0.19042.1645
microsoftwindows_10_21h1< 10.0.19043.164510.0.19043.1645
microsoftwindows_10_21h2< 10.0.19044.164510.0.19044.1645
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.1926510.0.10240.19265
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.506610.0.14393.5066
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.280310.0.17763.2803
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.280310.0.17763.2803
microsoftwindows_10_version_1909>= 10.0.0 < 10.0.18363.221210.0.18363.2212
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.164510.0.19042.1645
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.164510.0.19043.1645
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.164510.0.19044.1645
microsoftwindows_11_21h2< 10.0.22000.61310.0.22000.613
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.61310.0.22000.613
microsoftwindows_7>= 6.1.0 < 6.1.7601.259246.1.7601.25924
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.259246.1.7601.25924
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.203376.3.9600.20337
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.259246.1.7601.25924
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.214466.0.6003.21446
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.236796.2.9200.23679

Detection & IOCsextracted from sources · hover to see the quote

commandNtQuerySystemInformation with SystemExtendedHandleInformation (0x40)
commandNtFsControlFile with FsControlCode 0x11003C
commandNtFsControlFile with FsControlCode 0x110038
filenameApcHelper.sys
otherMemory address 0x40000000 (exploit buffer allocation target)
otherllCreateTime field set to 0x40000000 in crafted CLFS_CLIENT_CONTEXT
hashe4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
hash59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa
hash12459a5e9afdb2dbff685c8c4e916bb15b34745d56ef5f778df99416d2749261
hash5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1
hash792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0
  • Detect exploit BLF file manipulation: monitor for CreateLogFile API calls immediately followed by direct binary patching of the resulting .blf file (five specific field modifications including CLFS_BASE_RECORD_HEADER->rgClients[0] override) before AddLogContainer is called.
  • Detect PreviousMode manipulation: alert on kernel KTHREAD.PreviousMode field being decremented from 1 to 0 for a user-mode thread, enabling subsequent NtReadVirtualMemory/NtWriteVirtualMemory calls to access kernel memory.
  • Detect kernel address space enumeration via NtQuerySystemInformation with class 0x40 (SystemExtendedHandleInformation) from Medium IL processes, which is used by the exploit to locate KTHREAD, process tokens, and ClfsSetEndOfLog addresses.
  • Detect CLFS exploit pattern: monitor for a user-mode process allocating memory specifically at virtual address 0x40000000 followed by triggering CLFS operations, as the exploit places its controlled kernel callback data at this fixed address.
  • Detect CLFS exploit overlap technique: monitor for CLFS_CLIENT_CONTEXT and CLFS_CONTAINER_CONTEXT structures overlapping in a BLF file, specifically where cbSymbolZone points into the middle of an existing CLFS_CLIENT_CONTEXT structure.
  • Detect post-exploitation SAM dumping: alert on processes with newly elevated SYSTEM privileges accessing HKEY_LOCAL_MACHINE\SAM registry hive, consistent with post-CLFS-EoP credential harvesting behavior.
  • Detect Cuba ransomware / Tropical Scorpius: look for unsigned dropper loading a signed kernel driver (ApcHelper.sys) signed with the LAPSUS NVIDIA-leaked certificate, targeting security product processes for termination.
  • Detect Cuba ransomware file encryption marker: scan for files prepended with the magic bytes/string 'FIDEL.CA' (8 bytes) followed by an RSA-4096 encrypted block, and files with the '.cuba' extension appended.
  • Detect shared debug strings across CLFS exploit family: the presence of identical debug message strings across multiple exploit samples is a strong indicator of common authorship; hunt for these strings in memory or on disk across CLFS-related exploit artifacts.
  • ·The exploit targets Medium Integrity Level (Medium IL) processes; it will NOT work from Low IL contexts. Detection logic based on NtQuerySystemInformation class 0x40 should be scoped to Medium IL and above to avoid false negatives.
  • ·The PreviousMode technique used by this exploit is blocked in new builds of Windows 11 but remains viable on Windows 10 and Windows Server. Detection and patching priority should be higher for Windows 10 and Server environments.
  • ·The CVE-2022-24521 exploit was originally developed as a 1-day exploit after the April 2022 patch release; defenders should expect rapid weaponization of CLFS patches by the same threat actor group, as this pattern repeated across all five exploits in the series.
  • ·CLFS exception handlers in clfs.sys mask access violations triggered during exploitation (try/catch blocks suppress crashes), meaning crash-based detection or fuzzing will miss exploitation attempts; behavioral detection is required.
  • ·The exploit for CVE-2022-24521 uses the ObDereferenceObject function to decrement an arbitrary QWORD in kernel memory via a controlled address (0x40000000); the primitive is a decrement, not a direct write — detection rules should account for this indirect corruption pattern.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.