Hunting for Bugs in Windows Mini-Filter Drivers
Summary: Google Project Zero's James Forshaw detailed four Windows vulnerabilities Microsoft fixed in December in the Cloud Filter and Windows Overlay Filter (WOF) drivers: CVE-2020-17103, CVE-2020-17134, CVE-2020-17136, and CVE-2020-17139, comprising three local privilege escalations and one security feature bypass, all in file system filter drivers. The post explains how mini-filter drivers register callbacks with the Filter Manager, how altitude values order them, and how the fltmc tool lists registered filters and their attached volumes.
What's compelling: File system filter drivers can inspect and modify almost any IO request sent to a file system, and Forshaw notes he previously found six issues in the LUAFV driver alone, which implements UAC file virtualization - so the attack surface behind a local privilege escalation sits in code most teams never audit.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-17103CVE-2020-17134CVE-2020-17136CVE-2020-17139
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026