A newly uncovered flaw in the Common Log File System (CLFS.sys) driver on Windows has been revealed, impacting potentially millions of devices running Windows 10, Windows 11, and various versions of Windows Server.
Designated CVE-2024-6768, this flaw enables a malicious, authenticated user with low privileges to cause a Blue Screen of Death (BSOD) by forcing the KeBugCheckEx function to execute. This vulnerability results from improper validation of input data, categorized as CWE-1284. It can lead to persistent system crashes, data loss, and operational interruptions by causing the system to enter an unrecoverable state.
Fortra researcher Ricardo Narvaja demonstrated this vulnerability using a proof of concept (PoC) that manipulates specific values within a .BLF file, which is utilized by the Windows log file system. The PoC revealed that an unprivileged user can initiate a system crash without any user interaction, emphasizing the ease of exploiting this vulnerability.
Although the flaw is rated with a medium severity score of 6.8 on the Common Vulnerability Scoring System (CVSS), its potential for repeated exploitation poses a notable risk. The vulnerability requires local execution, which somewhat confines the range of possible attacks.
This discovery comes on the heels of a major incident involving CrowdStrike, where a problematic security update led to widespread BSODs on enterprise and business systems. The CrowdStrike issue, tied to a defective IPC Template Type in their Falcon software, resulted in similar system failures. These events highlight the importance of strong security protocols and vigilant system monitoring to address such vulnerabilities.
At present, no mitigations or patches are available for CVE-2024-6768. This vulnerability, affecting the CLFS.sys driver in Windows 10, Windows 11, and several Windows Server editions, allows a low-privilege user to trigger a BSOD due to faulty input validation.
