Quick Takeaways
- A Windows privilege escalation zero-day, codenamed MiniPlasma, exploits a flaw in cldflt.sys to grant SYSTEM privileges, potentially allowing attackers full control of affected systems.
- Despite prior assumptions of patching, the vulnerability remains unpatched and functional across all Windows versions, with a reliable proof-of-concept demonstrated by researchers.
- Attackers can weaponize MiniPlasma to spawn SYSTEM shells, increasing the risk of full system compromise, especially on latest Windows 11 updates.
Threat, Attack Techniques, and Targets
The threat involves a Windows zero-day vulnerability called MiniPlasma. This flaw affects the “cldflt.sys” component, which is known as the Windows Cloud Files Mini Filter Driver. The vulnerability is in a routine named “HsmOsBlockPlaceholderAccess.” A security researcher named Chaotic Eclipse developed a proof-of-concept (PoC) for this flaw. The PoC allows attackers to escalate privileges to SYSTEM level on fully patched Windows systems. The flaw was originally reported to Microsoft in September 2020, but it appears the issue was not fully fixed. The research indicates that the same problem still exists, and it can be exploited in all Windows versions. Attackers can use MiniPlasma to spawn a SYSTEM shell and gain full control of the system. Experts say the exploit works reliably on Windows 11 with the latest updates, though not on Windows Insider Preview versions. The vulnerability can be exploited by anyone with some technical knowledge and access to the target system.
Impact, Security Implications, and Remediation Guidance
The impact of MiniPlasma is serious. It allows attackers to gain SYSTEM privileges without needing additional permissions. This escalation can lead to complete control over the affected system. Attackers can run malicious code, steal data, or cause system disruption. Since the vulnerability impacts fully patched systems, it poses a higher risk. The security implication is that even systems with the latest updates might still be vulnerable, depending on whether patches have been applied or if the issue was silently unpatched. Currently, there is no specific remediation guidance provided in the information. Organizations should consult the vendor or relevant authority for guidance. It is recommended to monitor official Microsoft updates and advisories to ensure systems are protected.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
