teodor1231241/demo-proof-of-concept-temporal-memory-inconsistency-in-cldflt.sys-cve-2025-62221Proof-of-concept demonstrating a use-after-free in cldflt.sys (CVE-2025-62221) that enables local privilege escalation to SYSTEM via kernel pool grooming and token stealing.
DEMO Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys (CVE-2025-62221) CVE-2025-62221:
This repository provides a comprehensive technical analysis and a Proof-of-Concept (PoC) demonstration regarding a vertical privilege escalation vector. The vulnerability is identified as a Use-After-Free (UAF) primitive residing within the Windows Cloud Files Mini Filter Driver (cldflt.sys). This documentation details the mechanisms by which an unprivileged user-mode entity may transition to a Ring 0 (NT AUTHORITY\SYSTEM) security context.
The CVE-2025-62221 vulnerability stems from a critical failure in the temporal management of memory object lifecycles within the Windows kernel-mode executive subsystem. Specifically, the cldflt.sys driver fails to implement atomic reference counting during the processing of asynchronous I/O requests for cloud-backed reparse points. By orchestrating a non-deterministic race condition via malformed Input/Output Control (IOCTL) dispatch routines, a local actor may induce a dangling pointer scenario. This state permits kernel pool grooming, facilitating arbitrary write primitives and the subsequent substitution of security tokens.
| Parameter | Specification |
|---|---|
| Vulnerability Class | Temporal Memory Corruption / Use-After-Free (CWE-416) |
| Target Subsystem | Windows Cloud Files Mini Filter (cldflt.sys) |
| Exploitation Primitive | Kernel Pool Grooming and Token Exfiltration |
| Privilege Boundary | User-to-Kernel / Standard User to SYSTEM |
| CVSS v3.1 Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Base Score: 7.8) |
| Temporal Context | Identified Q4 2025; Remediation Patch Released January 2026 |
The exploitation methodology is structured into several discrete phases:
The procedure commences with an audit of the target kernel environment to verify the presence of the cldflt.sys module. It further calculates requisite offsets for the EPROCESS structure and associated security token fields relative to the specific Windows build in operation.
The exploit instantiates a series of sparse, cloud-backed directory structures. These structures serve as the primary interaction surface for the filter driver, enabling the manipulator to influence allocation patterns within the Non-Paged Kernel Pool.
Through the dispatch of concurrent, malformed I/O requests, the exploit induces an asynchronous state wherein a memory object is deallocated while an active reference persists within the driver's execution stack.
A Heap Spraying technique is utilized to occupy the recently vacated memory slot. The exploit populates the pool with controlled data structures, effectively transitioning the "Use-After-Free" condition into a "Type Confusion" or "Controlled Pointer Overwrite."
Upon successful hijacking of kernel-mode execution, the payload executes a Token Stealing operation. It identifies the SYSTEM process (PID 4) and replicates its primary access token into the security descriptor of the exploit's process.
[!CAUTION] Experimental Warning: This research is intended for academic validation and formal kernel-mode security auditing. Improper implementation may result in a Kernel Bug Check (BSOD) or filesystem corruption. All testing must be conducted within a strictly isolated hypervisor environment.
Initialize network topology:
sudo python3 topo.py
Open terminals for cloud and user nodes:
xterm cloud user
On the cloud terminal, navigate to project directory and start server:
cd ~/Downloads/sps_test
python3 server.py
On the user terminal, run automated exploit script (optional):
python3 run_all.py
Alternatively, execute each phase manually for granular observation.
Execute the following procedures sequentially within the user terminal to observe memory state transitions:
Step 1 — Allocated FileObject | REF=ref-12345
python3 1.py
Step 2 — Object freed
python3 2.py
Step 3 — DANGLING REF
python3 3.py
Step 4 — Heap reuse
python3 4.py
Step 5 — Handler overwritten
python3 5.py
Step 6 — MALICIOUS HANDLER EXECUTED
python3 6.py
Note: Upon successful pivot at phase 6, the system will execute the malicious command sequence defined within malware.json. You will observe execution messages on the cloud terminal and receive the malware command on the user terminal.
| File | Usage |
|---|---|
| topo.py | Mininet orchestration script defining the network boundary |
| server.py | Simulated cldflt.sys driver service incorporating the UAF logic |
| run_all.py | Automated exploitation script for efficient testing |
| user.py | Alternative automated exploitation script |
| 1.py through 6.py | Discrete exploitation stages provided for granular technical analysis |
| malware.json | Malicious payload utilized to demonstrate the code execution primitive : Malicious payload utilized to demonstrate the code execution primitive |
The documentation and code contained within this repository are provided exclusively for the advancement of cybersecurity research. The author accepts no liability for damages incurred through the use of this information. The objective of this research is to facilitate a comprehensive understanding of Mini Filter Driver vulnerabilities and to evaluate the efficacy of existing mitigation strategies.
Reference: Microsoft Security Response Center (MSRC) - CVE-2025-62221
Done for SPS Assignment UPB 2026