On May 14th, 2024, Microsoft patched a serious flaw, CVE-2024-30034, in Windows related to the Cloud Files Mini Filter Driver (cldflt.sys). This vulnerability is categorized as an information disclosure issue and can potentially allow a local attacker to get access to sensitive data on affected Windows machines.

In this post, we’ll break down what this vulnerability is, how it works under the hood, share a code snippet to demonstrate the risk, and provide helpful references for your further research.

What Is the Cloud Files Mini Filter Driver?

To make cloud storage seamless with native apps, Windows uses a special file system component called a mini filter driver, specifically cldflt.sys. If you’ve ever used OneDrive, Dropbox, or other integrated cloud providers, you’ve interacted with this component, even if you didn’t know it.

This driver intercepts file system operations, allowing cloud files to appear just like local files. However, certain mistakes in its design or implementation can allow unauthorized access to information — and that’s what CVE-2024-30034 is all about.

What’s the Issue in CVE-2024-30034?

When handling I/O operations, the Cloud Files Mini Filter Driver didn’t properly validate and isolate data, potentially leaking file metadata or contents. In other words, the bug made it possible for a local attacker (or malicious app running on the system) to read data from files they shouldn’t have access to.

According to Microsoft

> “An information disclosure vulnerability exists when the Windows Cloud Files Mini Filter Driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could view heap memory from a privileged process.”

- Microsoft Advisory

A Simple Exploit Scenario

Suppose a low-privileged user or process can interact with the filter driver (e.g., by opening cloud-linked files and triggering special I/O controls). By crafting specific requests or abusing how the driver interfaces with the OS, the attacker can retrieve sensitive data fragments from kernel memory or other user sessions.

While no public proof-of-concept (PoC) exploit has yet been widely published, the exploit generally follows this pattern:

1. Open a Cloud File: The attacker opens or creates a new file in a cloud-synced location (like OneDrive).

Issue IOCTL Requests: Send crafted DeviceIoControl or specific file operations to cldflt.sys.

3. Leak Data: Due to the information disclosure bug, responses might include out-of-bounds data, such as memory that was not properly cleared or sanitized.

Below is a pseudo-code that illustrates the basic idea (not an actual weaponized exploit!)

// Open a handle to a file in a cloud-synced folder
HANDLE hFile = CreateFile(
    L"C:\\Users\\username\\OneDrive\\test.txt",
    GENERIC_READ,
    FILE_SHARE_READ | FILE_SHARE_WRITE,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL
);

// Prepare an IOCTL request to trigger the bug
BYTE outBuffer[4096];
DWORD bytesReturned;
BOOL result = DeviceIoControl(
    hFile,
    IOCTL_CLDFLT_GET_PLACEHOLDER_STATE, // <— placeholder value
    NULL,
    ,
    outBuffer,
    sizeof(outBuffer),
    &bytesReturned,
    NULL
);

if (result) {
    // outBuffer may now contain leaked memory
    printf("Leak: %.*s\n", bytesReturned, outBuffer);
}

CloseHandle(hFile);

Note: The actual IOCTL and method will differ, but the exploit idea is similar: interact with the driver in ways it didn’t expect, and view extra data in an output buffer.

Any system with OneDrive or similar services running

*If you’re syncing files via OneDrive, this driver is almost certainly active on your machine.*

It can let a user or app steal plaintext data from higher-privileged sessions.

- It could expose password fragments, credentials, private files, or session tokens if those were ever in nearby heap memory.

It can be chained with privilege escalation or sandbox escapes in malware scenarios.

Attack complexity: Low
Attack vector: Local
Privileges required: Low
User interaction: None (in some cases)

How to Patch It

Update Windows ASAP! Microsoft’s May 2024 security patches fix this flaw. See the KB and CVE pages:

- Microsoft Security Response Center - CVE-2024-30034
- May 2024 Security Updates

More Details & References

- CVE Database Entry: https://www.cve.org/CVERecord?id=CVE-2024-30034
- MSRC Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30034
- Rapid7 Analysis: https://www.rapid7.com/db/vulnerabilities/windows-cloud-files-minifilter-information-disclosure-cve-2024-30034

Conclusion

CVE-2024-30034 is a notable reminder that even Microsoft’s trusted file system drivers can have dangerous flaws. If you manage Windows endpoints, push out the latest patches right away. If you’re a developer or researcher, keep an eye on cloud and sync filters — they’re complex and error-prone.

And finally, always check for updates before sharing sensitive files or syncing them with the cloud. You never know what vulnerabilities could be lurking just beneath the surface.

Stay safe, and patch often!

*(This post is written for educational purposes, and does not encourage or endorse actual exploitation. Always test responsibly in controlled environments.)*

Timeline

Published on: 05/14/2024 17:17:06 UTC
Last modified on: 08/02/2024 01:25:00 UTC