CVE-2022-37969
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Description
CVE-2022-37969 is a privilege escalation vulnerability in the Microsoft Windows Common Log File System (CLFS) driver that allows an authenticated local attacker to gain SYSTEM-level privileges. The CLFS driver contains an unspecified flaw that enables a low-privileged user to escalate to the highest system privilege level. CISA added CVE-2022-37969 to the KEV catalog on September 14, 2022. The EPSS score of 12.35% (93.77th percentile) indicates elevated exploitation probability, and the vulnerability has been confirmed as actively exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19444 |
| microsoft | windows 10 1607 | < 10.0.14393.5356 |
| microsoft | windows 10 1809 | < 10.0.17763.3406 |
| microsoft | windows 10 20h2 | < 10.0.19042.2006 |
| microsoft | windows 10 21h1 | < 10.0.19043.2006 |
| microsoft | windows 10 21h2 | < 10.0.19044.2006 |
| microsoft | windows 11 21h2 | < 10.0.22000.978 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5356 |
| microsoft | windows server 2019 | < 10.0.17763.3406 |
| microsoft | windows server 2022 | < 10.0.20348.1006 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37969(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2022-37969 exploits improper privilege management in the Windows Common Log File System driver. The CLFS driver fails to properly enforce privilege boundaries in its request handling, allowing an authenticated user with low privileges to escalate to SYSTEM-level access.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-37969 allows local privilege escalation from a low-privileged user to SYSTEM on Windows systems through the Common Log File System driver. The vulnerability requires local access and low privileges but has low complexity and no user interaction requirement. Confidentiality, integrity, and availability are highly impacted as SYSTEM access grants unrestricted control over the Windows system. The CLFS driver has been a recurring source of privilege escalation vulnerabilities, making it a well-known attack surface. The EPSS score of 12.35% indicates elevated exploitation probability compared to most vulnerabilities.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-37969 and added it to the KEV catalog on September 14, 2022, with a remediation deadline of October 5, 2022. The EPSS score of 12.35% (93.77th percentile) indicates elevated exploitation probability. The Windows CLFS driver has been repeatedly targeted by threat actors for privilege escalation, and this vulnerability continues that trend. The ransomware association is classified as unknown, but CLFS vulnerabilities have historically been used in ransomware attack chains.
Remediation
- Apply Microsoft security updates: Install the September 2022 Patch Tuesday updates that address CVE-2022-37969.
- Prioritize high-value systems: Focus patching on domain controllers, file servers, and other systems where local privilege escalation could have significant impact.
- Monitor CLFS activity: Enable auditing of the Common Log File System driver and monitor for unusual log file operations that may indicate exploitation attempts.
- Implement endpoint protection: Deploy EDR solutions configured to detect CLFS exploitation patterns and anomalous privilege escalation.
- Apply least privilege: Ensure users operate with the minimum required privileges to limit the starting point for privilege escalation attacks.
Technical Details
CVE-2022-37969 targets the Windows Common Log File System (CLFS) driver, which provides high-performance transaction logging for applications. The CLFS driver (clfs.sys) operates in kernel mode and has been a recurring target for privilege escalation attacks due to the complexity of its log file parsing code. The vulnerability allows a local attacker who has already obtained low-level access to a Windows system to escalate to SYSTEM privileges by exploiting a flaw in how the CLFS driver processes certain requests. The Windows CLFS subsystem is present on all modern Windows versions, making this vulnerability broadly applicable across Windows environments.
Frequently Asked Questions
Is CVE-2022-37969 being actively exploited?
Yes, CVE-2022-37969 has been actively exploited. CISA added it to the KEV catalog on September 14, 2022. The EPSS score of 12.35% indicates elevated exploitation probability.
What products are affected by CVE-2022-37969?
CVE-2022-37969 affects the Windows Common Log File System driver across Windows 10, Windows 11, and corresponding Windows Server versions.
How do I fix CVE-2022-37969?
Apply the September 2022 Microsoft security updates. Focus on systems where local privilege escalation would have the highest impact.
How severe is CVE-2022-37969?
CVE-2022-37969 is a high-severity privilege escalation vulnerability with an EPSS score of 12.35% (93.77th percentile). It allows local attackers to gain SYSTEM privileges through the Windows CLFS driver.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.