New Windows vulnerability could repeatedly trigger the blue screen of death on millions of devices

A new Windows vulnerability could be exploited by attackers to generate an unrecoverable inconsistency and repeatedly crash affected systems, researchers have warned.

Ricardo Narvaja, principal exploit writer at cybersecurity and automation software company Fortra, uncovered a vulnerability in the common log file system (CLFS.sys) driver of Windows.

Disclosed by Fortra on 12 August, CVE-2024-6768 is said to have been caused by improper validation of specified quantities in input data, leading to an unrecoverable inconsistency, which triggers the KeBugCheckEx function, resulting in the infamous blue screen of death.

A proof of concept (PoC) developed by Narvaja revealed that by crafting specific values within a .BLF file, the format of log files used by the Windows common log file system t, an unprivileged user could cause the target system to crash.

Despite only requiring low level account privileges and being listed as having a low attack complexity, CVE-2024-6768 is a medium severity security flaw rated a 6.8 on the CVSS, possibly due to a potential attacker requiring a local access in order to exploit it.

CVE-2024-6768 gives attackers “another tool in their post-compromise toolkit”

Tyler Reguly, associate director of security R&D at Fortra, told ITPro that due to fact  the attacker would already need access to the system to exploit it, this flaw is not the most dangerous to emerge recently, 

“To classify this vulnerability as dangerous would be a mistake. Not every vulnerability is world ending, but it is important that we still think about them and understand them. In this case, the attack vectors are limited as are the real-world use cases,” he explained.

“Since the attacker must have access to the system, we’re talking about an insider attack or someone who has already compromised your network, which means there’s a bigger risk that already exists. Next, we’re talking about crashing a system. There’s no code execution or privilege escalation associated with this; it is a straightforward denial of service. 

Reguly warned, however, that CVE-2024-6768 would be a handy addition to a hacker’s post-compromise toolkit. 

“Where the risk comes in is if someone wants to disrupt a multi-user environment or reboot a system where they don’t yet have increased privileges.,” he noted.

“This vulnerability doesn’t give an attacker the keys to the kingdom. Instead, it gives them another tool in their post-compromise toolkit – a self-recovering denial of service that essentially lets you reboot a system without permission to do so.”

Fortra’s blog warned the issue affects all versions of Windows, up to and including the latest versions of both Windows 10 and 11 with all updates applied.

Narvaja has made the functional PoC with sources as well as the crafted .BLF file available on Fortra’s GitHub for those looking to learn more about the vulnerability.