CVE-2023-36696 Overview
CVE-2023-36696 is an elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw stems from an out-of-bounds read condition [CWE-125] in the kernel-mode driver that backs cloud file synchronization features such as OneDrive Files On-Demand. A locally authenticated attacker can exploit the issue to escalate privileges on affected Windows systems. Microsoft published the advisory on December 12, 2023, addressing supported Windows 10, Windows 11, and Windows Server releases.
Critical Impact
Successful exploitation allows a low-privileged local user to achieve high impact on confidentiality, integrity, and availability through kernel-level privilege escalation.
Affected Products
- Microsoft Windows 10 (versions 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2
Discovery Timeline
- 2023-12-12 - CVE-2023-36696 published to NVD
- 2023-12-12 - Microsoft releases security patch via the December 2023 Patch Tuesday update
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-36696
Vulnerability Analysis
The vulnerability resides in the Cloud Files Mini Filter Driver cldflt.sys, which mediates I/O for cloud-backed placeholder files used by sync engines such as OneDrive. The driver runs in kernel mode and parses reparse-point data and IOCTL inputs supplied from user mode. A bounds-checking failure during this parsing allows the driver to read memory outside an allocated buffer. An attacker who controls the input crafts data that triggers the out-of-bounds read inside the kernel address space. The resulting memory disclosure or memory corruption can be chained to overwrite kernel structures and execute attacker-controlled code at SYSTEM. The local attack vector and low privileges required make this a viable post-compromise escalation primitive.
Root Cause
The root cause is improper validation of buffer boundaries [CWE-125] when cldflt.sys processes attacker-influenced cloud file metadata. The driver dereferences a length or offset field without verifying it against the size of the source buffer, reading adjacent kernel memory.
Attack Vector
Exploitation requires local code execution under any authenticated account. The attacker issues crafted IOCTL requests or interacts with reparse points associated with the cloud files filter, triggering the unchecked read path. No user interaction is required. The vulnerability mechanism is documented in the Microsoft Security Update Guide for CVE-2023-36696. No public proof-of-concept exploit code is available at the time of writing.
Detection Methods for CVE-2023-36696
Indicators of Compromise
- Unexpected loading or crashes of cldflt.sys recorded in the Windows System event log or WER reports.
- Creation of new processes running as NT AUTHORITY\SYSTEM from parent processes owned by standard users.
- Anomalous IOCTL traffic directed at the Cloud Files filter from non-OneDrive binaries.
Detection Strategies
- Monitor for kernel bugchecks (BSODs) referencing cldflt.sys that may indicate failed exploitation attempts.
- Hunt for token impersonation or process-token replacement events following execution of unsigned or untrusted binaries.
- Correlate Sysmon Event ID 1 (process create) with sudden integrity level transitions from Medium to System.
Monitoring Recommendations
- Enable kernel-mode driver auditing and forward Microsoft-Windows-Kernel-General and WER channels to a centralized log platform.
- Track patch state of cldflt.sys across the fleet and alert on hosts running pre-December 2023 driver versions.
- Baseline normal OneDrive sync engine behavior and alert on deviations involving placeholder or reparse point operations.
How to Mitigate CVE-2023-36696
Immediate Actions Required
- Apply the December 2023 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory endpoints to confirm the patched version of cldflt.sys is deployed and loaded.
- Restrict local logon rights and remove unnecessary interactive accounts on servers to reduce the local attacker pool.
Patch Information
Microsoft released fixes for CVE-2023-36696 in the December 12, 2023 Patch Tuesday cycle. Administrators should consult the Microsoft Security Update Guide entry for CVE-2023-36696 for the specific KB article and build numbers applicable to each Windows release. Apply cumulative updates through Windows Update, WSUS, or Microsoft Update Catalog.
Workarounds
- No official workaround is published; patching is the only supported remediation.
- Where patching must be delayed, enforce application allow-listing (such as Windows Defender Application Control) to block execution of untrusted local binaries that could trigger the driver.
- Apply least-privilege principles and enable attack surface reduction rules to limit post-exploitation impact.
# Verify the cldflt.sys driver version on a Windows host
Get-Item C:\Windows\System32\drivers\cldflt.sys | Select-Object -ExpandProperty VersionInfo
# Confirm the latest cumulative update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
