96613686/cve-2025-62454Exploit de prueba de concepto para CVE-2025-62454, una vulnerabilidad de corrupción de memoria del kernel de Windows en el controlador cldflt.sys, que provoca un fallo de página mediante solicitudes FSCTL manipuladas.
Esto no es una explotación, solo una POC
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff808b75973000
BUGCHECK_P2: 2
BUGCHECK_P3: fffff803df12ddda
BUGCHECK_P4: 0
READ_ADDRESS: ffff808b75973000 Special pool
MM_INTERNAL_CODE: 0
IMAGE_NAME: cldflt.sys
MODULE_NAME: cldflt
FAULTING_MODULE: fffff803df110000 cldflt
PROCESS_NAME: ConsoleApplication4.exe
DEVICE_OBJECT: ffffab823f964b10
DRIVER_OBJECT: 0000080100000000
TRAP_FRAME: ffffd10da5d2e8c0 -- (.trap 0xffffd10da5d2e8c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff808b75972ff8 rbx=0000000000000000 rcx=ffff808b75972ff8
rdx=ffffab8237fd6ef0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803df12ddda rsp=ffffd10da5d2ea58 rbp=ffffd10da5d2ea98
r8=0000000000000010 r9=0000000000000002 r10=0000000000000002
r11=ffffab821a3a0ef0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cldflt!memcpy+0x1a:
fffff803`df12ddda 4a895401f8 mov qword ptr [rcx+r8-8],rdx ds:ffff808b`75973000=????????????????
Resetting default scope
STACK_TEXT:
ffffd10d`a5d2de28 fffff800`ed0ece42 : ffffd10d`a5d2dea8 00000000`00000001 00000000`00000080 fffff800`ed1f7901 : nt!DbgBreakPointWithStatus
ffffd10d`a5d2de30 fffff800`ed0ec36c : 00000000`00000003 ffffd10d`a5d2df90 fffff800`ed1f7b00 ffffd10d`a5d2e550 : nt!KiBugCheckDebugBreak+0x12
ffffd10d`a5d2de90 fffff800`ed036537 : 00000000`00000000 fffff800`ecf11cb6 00000000`00000003 00000000`00000003 : nt!KeBugCheck2+0xb2c
ffffd10d`a5d2e620 fffff800`ed21654f : 00000000`00000050 ffff808b`75973000 00000000`00000002 ffffd10d`a5d2e8c0 : nt!KeBugCheckEx+0x107
ffffd10d`a5d2e660 fffff800`ecd80510 : ffff808b`1c100180 ffff8000`00000000 ffff808b`75973000 0000007f`fffffff8 : nt!MiSystemFault+0x3053a3
ffffd10d`a5d2e750 fffff800`ed1ecfcb : 00000000`00000020 ffffd10d`a5d2e920 ffff808b`b7092fd0 00000000`00000020 : nt!MmAccessFault+0x630
ffffd10d`a5d2e8c0 fffff803`df12ddda : fffff803`df161839 00000000`00000000 ffffd10d`a5d2ea98 ffff808b`75972fe0 : nt!KiPageFault+0x38b
ffffd10d`a5d2ea58 fffff803`df161839 : 00000000`00000000 ffffd10d`a5d2ea98 ffff808b`75972fe0 00000000`00000600 : cldflt!memcpy+0x1a
ffffd10d`a5d2ea60 fffff803`df162059 : ffffab81`00000000 ffffab81`d90a4fe0 ffffd10d`a5d2ebc0 ffffab81`d90a4fd0 : cldflt!HsmiGrantLockRequest+0x24d
ffffd10d`a5d2eae0 fffff803`df1630dc : 00000000`00000000 ffffd10d`a5d2ec39 ffffab82`116c6ad8 ffffab82`0810ce60 : cldflt!HsmFltProcessLockProperties+0x201
ffffd10d`a5d2eb70 fffff803`df16235f : ffffab82`116c6ad8 00000000`00000000 ffffab82`116c6af8 ffffab82`116c6a00 : cldflt!HsmFltProcessHSMControl+0x77c
ffffd10d`a5d2eca0 fffff800`7e4782cf : 00000000`00000000 00000000`00000000 ffffab82`116c6ad8 ffffd10d`a5d2ee10 : cldflt!HsmFltPreFILE_SYSTEM_CONTROL+0xff
ffffd10d`a5d2ed10 fffff800`7e4779b0 : ffffd10d`a5d2efc0 ffffab82`068e4a00 00000000`0000000d fffff800`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x59f
ffffd10d`a5d2ee70 fffff800`7e48c72f : ffffd10d`a5d29000 00000000`00000000 ffffab82`198e4ef0 00000000`00000000 : FLTMGR!FltpPassThroughInternal+0xc0
ffffd10d`a5d2ef20 fffff800`7e4cf3c0 : 00000000`00000000 ffffd10d`a5d2eff0 ffffab82`392fef20 ffffab81`c8648de0 : FLTMGR!FltpPassThrough+0x29f
ffffd10d`a5d2ef70 fffff800`eceeb63d : 00000000`00000002 ffffab82`198e4ef0 00000000`00000000 ffffab82`198e4ef0 : FLTMGR!FltpFsControl+0xe0
ffffd10d`a5d2f020 fffff800`ed410cc8 : ffffab82`198e4ef0 ffffd10d`a5d2f0d0 ffffab81`c8648de0 00000000`42536f49 : nt!IofCallDriver+0xcd
ffffd10d`a5d2f060 fffff800`ed40fb12 : ffffab82`3f964b10 00000000`00000000 ffffab82`198e4ef0 00000000`00000000 : nt!IopSynchronousServiceTail+0x1c8
ffffd10d`a5d2f110 fffff800`ed40e99e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x962
ffffd10d`a5d2f380 fffff800`ed1f1455 : 00000000`00000000 00007ff6`51645698 ffffd10d`a5d2f4e0 00007ff6`516456a8 : nt!NtFsControlFile+0x5e
ffffd10d`a5d2f3f0 00007ff9`26be2314 : 00007ff6`5164150e 000001db`d0bf9500 00007ff9`26be2680 000001db`d0bf9500 : nt!KiSystemServiceCopyEnd+0x25
000000c4`656ff788 00007ff6`5164150e : 000001db`d0bf9500 00007ff9`26be2680 000001db`d0bf9500 00007ff6`516432c0 : ntdll!NtFsControlFile+0x14
000000c4`656ff790 000001db`d0bf9500 : 00007ff9`26be2680 000001db`d0bf9500 00007ff6`516432c0 000000c4`656ff860 : ConsoleApplication4!main+0x48e [D:\source\repos\ConsoleApplication4\ConsoleApplication4.cpp @ 98]
000000c4`656ff798 00007ff9`26be267f : 000001db`d0bf9500 00007ff6`516432c0 000000c4`656ff860 00000000`000903bc : 0x000001db`d0bf9500
000000c4`656ff7a0 000001db`d0bf9500 : 00007ff6`516432c0 000000c4`656ff860 00000000`000903bc 000000c4`656ff8c0 : ntdll!NtReadRequestData+0x1f
000000c4`656ff7a8 00007ff6`516432c0 : 000000c4`656ff860 00000000`000903bc 000000c4`656ff8c0 00000000`00000098 : 0x000001db`d0bf9500
000000c4`656ff7b0 000000c4`656ff860 : 00000000`000903bc 000000c4`656ff8c0 00000000`00000098 00000000`00000000 : ConsoleApplication4!`string'
000000c4`656ff7b8 00000000`000903bc : 000000c4`656ff8c0 00000000`00000098 00000000`00000000 00000000`00000000 : 0x000000c4`656ff860
000000c4`656ff7c0 000000c4`656ff8c0 : 00000000`00000098 00000000`00000000 00000000`00000000 00000000`00000000 : 0x903bc
000000c4`656ff7c8 00000000`00000098 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000000c4`656ff8c0
000000c4`656ff7d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00560054 : 0x98
SYMBOL_NAME: cldflt!memcpy+1a
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 1a
FAILURE_BUCKET_ID: AV_VRFK_W_(null)_cldflt!memcpy
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {dec4b7a6-102b-cd22-2950-8987b7ed5fc9}
Followup: MachineOwner
---------