Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)

This part of a multi-part analysis details Exploit #3 against the Windows CLFS driver (October 2022), describing how an attacker patches BLF file fields to create overlapping CLFS structures and overwrite kernel pointers; the exploit is closely related to previously reported CVEs and was observed used in ransomware attacks.