
Prueba de concepto para CVE-2025-62470, una vulnerabilidad de corrupción de memoria del kernel de Windows en CLFS.SYS desencadenada mediante llamadas DeviceIoControl manipuladas, causando una condición de denegación de servicio.
Esto no es una explotación, solo una POC
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffc101f6bf91be
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8007e194409
BUGCHECK_P4: 0
READ_ADDRESS: ffffc101f6bf91be
MM_INTERNAL_CODE: 0
IMAGE_NAME: CLFS.SYS
MODULE_NAME: CLFS
FAULTING_MODULE: fffff8007e190000 CLFS
PROCESS_NAME: ConsoleApplication4.exe
TRAP_FRAME: ffffd10da5abe990 -- (.trap 0xffffd10da5abe990)
NOTA: El marco de trampa no contiene todos los registros.
Algunos valores de registros pueden estar puestos a cero o incorrectos.
rax=0000000000000e00 rbx=0000000000000000 rcx=0000000000000e00
rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8007e194409 rsp=ffffd10da5abeb20 rbp=ffffd10da5abf0d0
r8=ffffc101f6bf81ce r9=0000000000001004 r10=0000000000001000
r11=ffffc101f6bf81c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
CLFS!ClfsEncodeBlock+0x139:
fffff800`7e194409 420fb78418fe010000 movzx eax,word ptr [rax+r11+1FEh] ds:ffffc101`f6bf91be=????
Resetting default scope
STACK_TEXT:
ffffd10d`a5abdef8 fffff800`ed0ece42 : ffffd10d`a5abdf78 00000000`00000001 00000000`00000080 fffff800`ed1f7901 : nt!DbgBreakPointWithStatus
ffffd10d`a5abdf00 fffff800`ed0ec36c : 00000000`00000003 ffffd10d`a5abe060 fffff800`ed1f7b00 ffffd10d`a5abe620 : nt!KiBugCheckDebugBreak+0x12
ffffd10d`a5abdf60 fffff800`ed036537 : ffffa552`a954ac10 fffff800`ecf11c8b 00000000`00000003 00000000`00000003 : nt!KeBugCheck2+0xb2c
ffffd10d`a5abe6f0 fffff800`ed21654f : 00000000`00000050 ffffc101`f6bf91be 00000000`00000000 ffffd10d`a5abe990 : nt!KeBugCheckEx+0x107
ffffd10d`a5abe730 fffff800`ecd80510 : ffffab82`1b001300 ffff8000`00000000 ffffc101`f6bf91be 0000007f`fffffff8 : nt!MiSystemFault+0x3053a3
ffffd10d`a5abe820 fffff800`ed1ecfcb : 00000000`00000000 00000000`00000001 00000000`00000020 fffff800`ed14efb6 : nt!MmAccessFault+0x630
ffffd10d`a5abe990 fffff800`7e194409 : 00020002`00990000 fffff800`7e194c13 00020002`00990104 ffffffff`00000000 : nt!KiPageFault+0x38b
ffffd10d`a5abeb20 fffff800`7e194c13 : 00020002`00990104 ffffffff`00000000 ffffffff`00000000 ffffc101`f6bf81c0 : CLFS!ClfsEncodeBlock+0x139
ffffd10d`a5abeb30 fffff800`7e200409 : ffffab81`f913d260 ffffab82`25b20ef0 ffffab81`fe148e01 ffffc101`f6bf81c0 : CLFS!CClfsLogFcbPhysical::AppendRegion+0x733
ffffd10d`a5abec80 fffff800`7e205de5 : ffffab81`fa180d60 ffffab82`25b20ef0 ffffab81`fe148fb0 ffffab81`f95cefb0 : CLFS!CClfsLogFcbVirtual::ReserveAndAppendLog+0x129
ffffd10d`a5abed60 fffff800`7e1d66d7 : ffffab81`fa180d60 ffffab82`25b20ef0 ffffc101`f6bf81c0 ffffab82`00000e18 : CLFS!CClfsLogFcbVirtual::WriteRestart+0x465
ffffd10d`a5abee60 fffff800`7e1fb7af : ffffab81`fe148ec0 fffff800`ece4a508 00000000`00000000 ffffab82`13966fc0 : CLFS!CClfsRequest::WriteRestart+0x34f
ffffd10d`a5abef50 fffff800`7e1fb18d : ffffab81`fe148ec0 ffffab81`c7006da0 ffffab81`f95ceee0 ffffab82`25b20ef0 : CLFS!CClfsRequest::Dispatch+0x363
ffffd10d`a5abefa0 fffff800`7e1fb0bc : 00000000`00000000 ffffab81`f95ceee0 ffffab81`f95ceee0 00000000`00000000 : CLFS!ClfsDispatchIoRequest+0x8d
ffffd10d`a5abeff0 fffff800`eceeb63d : ffffab81`c7006da0 ffffab82`25b20ef0 00000000`00000000 00000000`00000000 : CLFS!CClfsDriver::LogIoDispatch+0x3c
ffffd10d`a5abf020 fffff800`ed410cc8 : ffffab82`25b20ef0 ffffd10d`a5abf0d0 ffffab81`c7006da0 00000000`00000001 : nt!IofCallDriver+0xcd
ffffd10d`a5abf060 fffff800`ed40fb12 : 00000000`8007281f 00000000`00000001 ffffab82`25b20ef0 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c8
ffffd10d`a5abf110 fffff800`ed40f19e : 00000000`00000100 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x962
ffffd10d`a5abf380 fffff800`ed1f1455 : 00000000`00000000 00000000`0000001a 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffd10d`a5abf3f0 00007ff9`26be1cd4 : 00007ff9`2413a293 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000cc`bddff6c8 00007ff9`2413a293 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtDeviceIoControlFile+0x14
000000cc`bddff6d0 00007ff9`257132b5 : 00000000`8007281f 00007ff9`241b6194 00000000`00000000 00000000`00000000 : KERNELBASE!DeviceIoControl+0x73
000000cc`bddff740 00007ff6`c6ec10e5 : 000001ce`254e21b0 00000000`01000000 00000000`00000000 00000000`00000000 : KERNEL32!DeviceIoControlImplementation+0x75
000000cc`bddff790 000001ce`254e21b0 : 00000000`01000000 00000000`00000000 00000000`00000000 00004000`000001c0 : ConsoleApplication4!main+0xe5 [D:\source\repos\ConsoleApplication4\ConsoleApplication4.cpp @ 65]
000000cc`bddff798 00000000`01000000 : 00000000`00000000 00000000`00000000 00004000`000001c0 00007ff9`00000e18 : 0x000001ce`254e21b0
000000cc`bddff7a0 00000000`00000000 : 00000000`00000000 00004000`000001c0 00007ff9`00000e18 00000000`00000000 : 0x1000000
SYMBOL_NAME: CLFS!ClfsEncodeBlock+139
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 139
FAILURE_BUCKET_ID: AV_VRFK_R_(null)_CLFS!ClfsEncodeBlock
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3e88624b-fe4e-8625-d246-2b9bea7b2229}
Followup: MachineOwner
---------