Pr0Ln

**Name of the Vulnerable Software and Affected Versions** Windows Cloud Files Mini Filter Driver (affected versions not specified) **Description** An elevation of privilege issue exists in the Windows Cloud Files Mini Filter Driver `cldflt.sys`. The flaw is a heap-based buffer overflow that can be triggered by crafting a custom reparse point to corrupt an adjacent ` WNF STATE DATA` object. This corruption can be leveraged to leak kernel pointers from an ALPC handle table object. Further exploitation involves a second buffer overflow to corrupt another ` WNF STATE DATA` object and a subsequent PipeAttribute object. By forging a PipeAttribute object in userspace, an attacker can leak the token address and override privileges to escalate a regular user account to NT AUTHORITYSYSTEM. Technical exploitation strategies include the use of WNF Out-of-Bounds (OOB), ALPC, I/O Ring mechanisms, and flipping the ` KTHREAD.PreviousMode` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Workstation and Fusion (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine. This is due to insufficient access control in the HGFS functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Workstation versions prior to 17.5 VMware Fusion versions prior to 13.5 **Description** An out-of-bounds read issue exists in the functionality used to share host Bluetooth devices with a virtual machine. A malicious actor with local administrative privileges on a virtual machine can exploit this to read privileged information stored in the hypervisor memory. **Recommendations** Update VMware Workstation to version 17.5 or later. Update VMware Fusion to version 13.5 or later.