Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteRequest use-after-free 漏洞
Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteRequest use-after-free 漏洞
CVE编号
CVE-2026-58613
摘要
Windows Cloud Files Mini Filter Driver（版本：10.0.26100.8457，WinBuild.160101.0800））的 CldiStreamCompleteRequest 功能中存在一个“use-after-free”漏洞。专门设计的云过滤API调用序列可能导致权限提升。攻击者可以执行专用应用程序来触发该漏洞。
已确认的易受攻击版本
以下版本要么经过Talos测试或验证存在漏洞，要么由厂商确认存在漏洞。
Windows Cloud Files Mini Filter Driver（版本：10.0.26100.8457 （WinBuild.160101.0800））
产品网址
Windows Cloud 文件迷你过滤器驱动 - https://www.microsoft.com/
CVSSv3评分
8.8 - CVSS：3.1/AV：L/AC：L/PR：L/UI：N/S：C/C：H/I：H/A：H
CWE
CWE-416 - 免费后使用
详情
云文件迷你过滤器驱动（cldflt.sys）是一款Microsoft的Windows内核模式文件系统驱动程序，支持云存储集成功能，如OneDrive按需文件。它管理基于云的占位文件，同步本地存储与云服务之间的数据，并在用户访问文件时自动下载。该驱动程序在 Windows 文件系统堆栈中运行，使云文件表现得像普通本地文件。
背景：全球倒计时列表
Cloud Files Mini-Filter 驱动管理同步引擎（如 OneDrive、Dropbox 等）的云占位文件，并处理按需文件水合。驱动维护一个系统范围的全局倒计时列表——一个内核模式链表，用于跟踪发送给云同步提供商的所有待处理的阻断请求。这种看门狗机制确保如果提供者无响应，文件系统不会无限期挂起。每个提交请求的请求都被分配了60秒的截止时间。
全局计时器列表用于几个核心场景：
文件水合、目录填充、通知确认，最重要的是针对该漏洞：
提供者进展报告：当同步提供者调用/报告不完整的水合进度（例如“下载了1000 KB中的297 KB”）时，驱动程序会在计时器列表中创建内部提供者请求。这使得系统能够跟踪正在进行的转账，并在提供者消失时取消。CfReportProviderProgressCfReportProviderProgress2
请求的60秒截止时间届满后，驱动程序的内部定时器DPC触发，工作线程会遍历全局列表，取消所有过期请求。这次步行也可以手动触发，使用未公开的 API 调用（Windows Shell 用于在文件资源管理器中显示水合进度条）。CfQueryProgress
脆弱触发
步骤1：向全局计时器列表添加请求
云同步提供商呼叫或报告占位文件上的不完整水合进度（例如，已出）。在核内部，它遍历：CfReportProviderProgressCfReportProviderProgress2completed=297total=1000
User-mode: CfReportProviderProgress2(connKey, transferKey, reqKey, total=1000, completed=297, sessionId=0)
→ cldapi!CfReportProviderProgress2 → FilterSendMessage
→ cldflt!CldiPortNotifyMessage
→ CldiPortProcessTransfer
→ CldiPortProcessReportProgress
→ CldSyncReportProgress
→ CldStreamReportProgress
→ CldiStreamBuildProviderRequest
→ CldiStreamInsertIntoGlobalRequestListNoLock ← INSERT_GLOBAL
The request is created when and no existing provider request is pending on the stream. At this point, the request holds a reference to the via . The stream context’s FltMgr refcount is > 1 (the file on disk, the NTFS file object, and various FltMgr internals all contribute additional references).progressCompleted < progressTotalHSM_STREAM_CONTEXTpRequest->pStreamHandleCtx->pStreamCtx
Step 2: Orphaning the request via process termination
The provider process terminates — without calling or . Result: the request survives on the global timer list after the provider process is gone. It becomes an orphan — no user-mode provider will ever complete it, and no disconnect logic will clean it up. The only thing that will touch it is the 60-second timeout mechanism. Note: , if called from the same process, would drain the request from the global list with status (0xC000CF16). By terminating the process without calling it, this cleanup path is bypassed entirely.CfDisconnectSyncRootCfUnregisterSyncRootCfUnregisterSyncRootSTATUS_CLOUD_FILE_PROVIDER_TERMINATED
Step 3: Eroding the stream context refcount
Removing files and placeholders from the sync root directory (e.g., via ) causes NTFS file close operations. Each file close traverses the NTFS → FltMgr cleanup path, which calls on cached stream context references. This erodes the refcount, eventually leaving the orphaned timer-list request as the sole remaining reference (refcount == 1).rmdir /s /qFltReleaseContextHSM_STREAM_CONTEXT
Step 4: Timer expiry and the UAF trigger
Approximately 60 seconds after the request was inserted (Step 1), its deadline expires. We trigger the timer walk by calling the undocumented API, which sends port command to . In the kernel, this enters:CfQueryProgress0x4001\CLDMSGPORT
CfQueryProgress
→ FilterSendMessage (port cmd 0x4001)
→ CldiPortProcessFilterControl
→ CldiPortProcessQueryProgress
→ CldStreamQueryProgress
→ CldiStreamRestartCountdownTimer
→ CldiStreamStartCountdownTimer(bCancelAll=0)
CldiStreamStartCountdownTimer walks the global request list and cancels all expired requests:
do {
AcquireResourceExclusive(&Resource);
if (ListEmpty) break;
pRequest = HEAD of list;
deadline = pRequest->DeadlineTimestamp;
if (deadline > currentTime) // NOT expired
break; // re-arm timer for remaining time
// EXPIRED:
RemoveFromGlobalList(pRequest);
pRequest->RemovedFromGlobalList = 1;
ReleaseResource(&Resource);
if (pRequest->MasterRequest)
FltCancelIo(pRequest->MasterRequest->UserCbd); // CVE-2023-29361 path (IRP-based)
else
CldiStreamCancelSynchronousRequest(pRequest); // OUR vulnerability path (no IRP)
} while (1);
Our request has because it was created by (a provider-initiated operation with no associated user I/O request). This takes the path, which eventually calls .MasterRequest == NULLCfReportProviderProgress2CldiStreamCancelSynchronousRequestCldiStreamCompleteRequest
Step 5: CldiStreamCompleteRequest - UAF
When cldflt crashes we see the following state:
6: kd> kb
# RetAddr : Args to Child : Call Site
00 fffff807`7d540e8c : 00000000`00000000 00000000`00000000 ffffcb82`900f2a80 00000000`00000000 : cldflt!CldiStreamCompleteRequest+0x12f
01 fffff807`7d540a60 : 00000000`00000000 ffffcb82`900f2a80 ffffc80b`34feea68 ffffa685`a7a86f10 : cldflt!CldiStreamCompleteCanceledRequest+0x234
02 fffff807`7d534ec0 : 01dcec7b`5946f732 ffffcb82`900f2a80 00000000`00000002 00000000`00000100 : cldflt!CldiStreamCancelSynchronousRequest+0x68
03 fffff807`7d5376ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiStreamStartCountdownTimer+0x150
04 fffff807`7d57cc0f : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000100 : cldflt!CldiStreamRestartCountdownTimer+0x66
05 fffff807`7d57b50c : 00000000`00000001 0000000e`dabfdf90 00000000`00001c20 ffffc80b`34feed68 : cldflt!CldStreamQueryProgress+0x168b
06 fffff807`7d57b209 : 00000000`00004001 00000000`00000000 00000001`00001c20 ffffcb82`90f6cf20 : cldflt!CldiPortProcessQueryProgress+0x2b4
07 fffff807`7d54af49 : 00000000`00004001 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x4d
08 fffff801`4f233622 : ffffcb82`90ee6ee0 0000000e`dabfde30 00000000`000000e0 0000000e`dabfddb0 : cldflt!CldiPortNotifyMessage+0xcc9
09 fffff801`4f27f632 : ffffa685`af8dad60 0000000e`dabfde30 ffffa685`af8dae30 fffff801`be5259c0 : FLTMGR!FltpFilterMessage+0x162
0a fffff801`4f23b9c3 : ffffa685`af8dad60 ffffc80b`34fef0d0 ffffa685`a05a4bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
0b fffff801`bd96ccfb : ffffc80b`34fef008 00000000`00060000 ffffa685`b0624ac0 fffff801`bdf561b9 : FLTMGR!FltpDispatch+0x133
0c fffff801`bd96cc73 : ffffa685`b0624ac0 ffffa685`b0624ac0 00000020`00000000 00000000`00000000 : nt!IopfCallDriver+0x5b
0d fffff801`bdfdb3a5 : ffffa685`b0624ac0 ffffc80b`34fef0d0 ffffa685`a05a4bf0 00000000`00000000 : nt!IofCallDriver+0x13
0e fffff801`bdfda1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
0f fffff801`bdfd983e : 00000000`00000000 fffff801`bda3ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
10 fffff801`bddcc558 : 00000000`00000000 00000000`00000000 0000000e`da776000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
11 00007ffd`b8de1d84 : 00007ffd`aa833bc2 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
12 00007ffd`aa833bc2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtDeviceIoControlFile+0x14
13 00007ffd`aa8331a1 : 00000000`00000000 0000000e`dabfdf80 00000000`00000000 00000000`00000000 : FLTLIB!FilterpDeviceIoControl+0x13e
14 00007ffd`a4503434 : 00000000`00000000 00000000`00000000 0000000e`dabfde70 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
15 00007ff7`9cb147fc : 00000000`00000000 00000000`00000000 ffffffff`ffffd8f0 00000000`00000000 : cldapi!CfQueryProgress+0x3f4
16 00000000`00000000 : 00000000`00000000 ffffffff`ffffd8f0 00000000`00000000 00000000`00000032 : poc+0x47fc
6: kd> r
rax=0000000000000036 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000034 rsi=ffffcb82900f2a80 rdi=0000000000000000
rip=fffff8077d58435b rsp=ffffc80b34fee920 rbp=ffffcb8290ebaf80
r8=0000000000000036 r9=0000000000000001 r10=fffff801bd91de80
r11=ffffa685abe1c430 r12=00000000c000cf1f r13=00270000000289b7
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040282
cldflt!CldiStreamCompleteRequest+0x12f:
fffff807`7d58435b 488b4500 mov rax,qword ptr [rbp] ss:0018:ffffcb82`90ebaf80=????????????????
To have a better picture let us take a glance on the most important parts of :CldiStreamCompleteRequest
Line 1 void __fastcall CldiStreamCompleteRequest(
Line 2 HSM_STREAM_HANDLE_CONTEXT *pStreamHandleCtx,
Line 3 CLD_STREAM_REQUEST *pRequest,
Line 4 __int64 completionStatus,
Line 5 unsigned int cancelFlags)
Line 6 {
Line 7
Line 8 (...)
Line 9 if ( (unsigned int)Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1() ) //Code introduced in May update
Line 10 {
Line 11 CldiStreamDeleteRequest(pRequest); // <-- First FREE REQUEST ?!
Line 12 CldiStreamCdqRELEASE((PFLT_CALLBACK_DATA_QUEUE)(*((_QWORD *)pStreamHandleCtx->pStreamCtx + 1) + 144LL), v15);// UAF!!!
Line 13 }
Line 14 else
Line 15 {
Line 16 if ( !pRequest->TimeoutType )
Line 17 CldiStreamCdqRELEASE((PFLT_CALLBACK_DATA_QUEUE)(*((_QWORD *)pStreamHandleCtx->pStreamCtx + 1) + 144LL), v14);
Line 18 CldiStreamDeleteRequest(pRequest);
Line 19 }
We can see that in our request will be freed. Let us remind that keeps the following fields in its structure : and Inside function, drops the stream context refcount. Since our orphaned request holds the last reference (refcount == 1 after Step 3), the refcount drops to zero. This synchronously triggers the FltMgr cleanup callback chain — on the same thread, in the same call stack:line 11pRequestpRequest->pStreamHandleCtxpStreamHandleCtx->pStreamCtxCldiStreamDeleteRequestFltReleaseContext
CldiStreamDeleteRequest+0xC5: FltReleaseContext(pStreamCtx)
→ FltMgr: refcount → 0, invoke cleanup callback
→ HsmFltDeleteSTREAM_CONTEXT+0x1E
→ CldHsmDeleteStreamContext+0x1B
→ CldStreamClose+0x154: ExFreePoolWithTag(pCldStream, 'Clst') ← POOL BLOCK FREED
When execution returns to , it attempts which dereferences — a pointer to the just-freed pool block. We can verify the value from the crash:CldiStreamCompleteRequestCldiStreamCdqRELEASEpStreamHandleCtx->pStreamCtxrbp
6: kd> !verifier 0x80 ffffcb82`90ebaf80
======================================================================
Pool block ffffcb8290ebaf80, Size 0000000000000080, Thread ffffa685ad7e7080
fffff801bda59700 nt!ExpFreePoolChecks+0x40
fffff801be282eca nt!ExFreePoolWithTag+0x165a
fffff801bdd2b8cc nt!DifExFreePoolWithTagWrapper+0xdc
fffff8077d5737b0 cldflt!CldStreamClose+0x160
fffff8077d57362b cldflt!CldHsmDeleteStreamContext+0x1b
fffff8077d57400e cldflt!HsmFltDeleteSTREAM_CONTEXT+0x1e
fffff8014f223c57 FLTMGR!FltReleaseContext+0x437
fffff8077d534ce1 cldflt!CldiStreamDeleteRequest+0xc5
fffff8077d58435b cldflt!CldiStreamCompleteRequest+0x12f
fffff8077d540e8c cldflt!CldiStreamCompleteCanceledRequest+0x234
fffff8077d540a60 cldflt!CldiStreamCancelSynchronousRequest+0x68
fffff8077d534ec0 cldflt!CldiStreamStartCountdownTimer+0x150
fffff8077d5376ee cldflt!CldiStreamRestartCountdownTimer+0x66
fffff8077d57cc0f cldflt!CldStreamQueryProgress+0x168b
fffff8077d57b50c cldflt!CldiPortProcessQueryProgress+0x2b4
fffff8077d57b209 cldflt!CldiPortProcessFilterControl+0x4d
fffff8077d54af49 cldflt!CldiPortNotifyMessage+0xcc9
fffff8014f233622 FLTMGR!FltpFilterMessage+0x162
fffff8014f27f632 FLTMGR!FltpMsgDispatch+0xf2
fffff8014f23b9c3 FLTMGR!FltpDispatch+0x133
fffff801bd96ccfb nt!IopfCallDriver+0x5b
fffff801bd96cc73 nt!IofCallDriver+0x13
fffff801bdfdb3a5 nt!IopSynchronousServiceTail+0x1c5
fffff801bdfda1ec nt!IopXxxControlFile+0x99c
fffff801bdfd983e nt!NtDeviceIoControlFile+0x5e
fffff801bddcc558 nt!KiSystemServiceCopyEnd+0x28
The poor object memory management handling has led to a potentially dangerous use-after-free vulnerability, which may consequently result in local privilege escalations.
Crash Information
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffcb8290ebaf80, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff8077d58435b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\repro_stream_uaf\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\repro_stream_uaf\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\repro_stream_uaf\poc.exe, Win32 error 0n2
KEY_VALUES_STRING: 1
Key : AV.PTE
Value: Invalid
Key : AV.Page.Virtual
Value: 0xffffcb8290eb0000
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 3875
Key : Analysis.Elapsed.mSec
Value: 7253
Key : Analysis.IO.Other.Mb
Value: 2030
Key : Analysis.IO.Read.Mb
Value: 45
Key : Analysis.IO.Write.Mb
Value: 5291
Key : Analysis.Init.CPU.mSec
Value: 1395312
Key : Analysis.Memory.CommitPeak.Mb
Value: 633
Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002
Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre
Key : Analysis.Version.Ext
Value: 1.2602.27.2
Key : Bugcheck.Code.KiBugCheckData
Value: 0x50
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Bugcheck.Code.TargetModel
Value: 0x50
Key : Failure.Bucket
Value: AV_VRF_cldflt!CldiStreamCompleteRequest
Key : Failure.Exception.IP.Address
Value: 0xfffff8077d58435b
Key : Failure.Exception.IP.Module
Value: cldflt
Key : Failure.Exception.IP.Offset
Value: 0x8435b
Key : Failure.Hash
Value: {61f2862e-d255-0a0b-0f7e-ddec7a333e8f}
Key : Faulting.IP.Type
Value: Paged
Key : Hypervisor.Enlightenments.ValueHex
Value: 0x6090ebf4
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 1
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 659693
Key : Hypervisor.Flags.ValueHex
Value: 0xa10ed
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 1
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0x0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffcb8290ebaf80
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8077d58435b
BUGCHECK_P4: 0
FAULTING_THREAD: ffffa685ad7e7080
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffcb8290ebaf80
READ_ADDRESS: ffffcb8290ebaf80 Special pool
PROCESS_NAME: poc.exe
IP_IN_PAGED_CODE:
cldflt!CldiStreamCompleteRequest+12f
fffff807`7d58435b 488b4500 mov rax,qword ptr [rbp]
STACK_TEXT:
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\repro_stream_uaf\poc.exe, Win32 error 0n2
ffffc80b`34fedcf8 fffff801`bdcbfa92 : ffffc80b`34fedd78 00000000`00000001 00000000`00000080 fffff801`bddd2a01 : nt!DbgBreakPointWithStatus
ffffc80b`34fedd00 fffff801`bdcbefbe : 00000000`00000003 ffffc80b`34fede60 fffff801`bddd2c90 ffffc80b`34fee420 : nt!KiBugCheckDebugBreak+0x12
ffffc80b`34fedd60 fffff801`bdc08557 : 00000000`00000000 fffff801`bda1caf2 00000000`00000003 00000000`00000003 : nt!KeBugCheck2+0xb2e
ffffc80b`34fee4f0 fffff801`bda1e89d : 00000000`00000050 ffffcb82`90ebaf80 00000000`00000000 ffffc80b`34fee790 : nt!KeBugCheckEx+0x107
ffffc80b`34fee530 fffff801`bd953e96 : 00000000`00000000 ffff8000`00000000 ffffcb82`90ebaf80 0000007f`fffffff8 : nt!MiSystemFault+0x78d
ffffc80b`34fee620 fffff801`bddc80cb : ffffcb82`90ebaf80 ffffcb82`90ebaf80 00000000`00000000 ffffa685`a3dad420 : nt!MmAccessFault+0x646
ffffc80b`34fee790 fffff807`7d58435b : 00000000`00000000 ffffcb82`900f2a80 00000000`00000000 00004001`00000001 : nt!KiPageFault+0x38b
ffffc80b`34fee920 fffff807`7d540e8c : 00000000`00000000 00000000`00000000 ffffcb82`900f2a80 00000000`00000000 : cldflt!CldiStreamCompleteRequest+0x12f
ffffc80b`34fee9a0 fffff807`7d540a60 : 00000000`00000000 ffffcb82`900f2a80 ffffc80b`34feea68 ffffa685`a7a86f10 : cldflt!CldiStreamCompleteCanceledRequest+0x234
ffffc80b`34feea40 fffff807`7d534ec0 : 01dcec7b`5946f732 ffffcb82`900f2a80 00000000`00000002 00000000`00000100 : cldflt!CldiStreamCancelSynchronousRequest+0x68
ffffc80b`34feea70 fffff807`7d5376ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiStreamStartCountdownTimer+0x150
ffffc80b`34feeaa0 fffff807`7d57cc0f : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000100 : cldflt!CldiStreamRestartCountdownTimer+0x66
ffffc80b`34feeae0 fffff807`7d57b50c : 00000000`00000001 0000000e`dabfdf90 00000000`00001c20 ffffc80b`34feed68 : cldflt!CldStreamQueryProgress+0x168b
ffffc80b`34feecc0 fffff807`7d57b209 : 00000000`00004001 00000000`00000000 00000001`00001c20 ffffcb82`90f6cf20 : cldflt!CldiPortProcessQueryProgress+0x2b4
ffffc80b`34feed30 fffff807`7d54af49 : 00000000`00004001 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x4d
ffffc80b`34feed60 fffff801`4f233622 : ffffcb82`90ee6ee0 0000000e`dabfde30 00000000`000000e0 0000000e`dabfddb0 : cldflt!CldiPortNotifyMessage+0xcc9
ffffc80b`34feee70 fffff801`4f27f632 : ffffa685`af8dad60 0000000e`dabfde30 ffffa685`af8dae30 fffff801`be5259c0 : FLTMGR!FltpFilterMessage+0x162
ffffc80b`34feeee0 fffff801`4f23b9c3 : ffffa685`af8dad60 ffffc80b`34fef0d0 ffffa685`a05a4bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
ffffc80b`34feef50 fffff801`bd96ccfb : ffffc80b`34fef008 00000000`00060000 ffffa685`b0624ac0 fffff801`bdf561b9 : FLTMGR!FltpDispatch+0x133
ffffc80b`34feeff0 fffff801`bd96cc73 : ffffa685`b0624ac0 ffffa685`b0624ac0 00000020`00000000 00000000`00000000 : nt!IopfCallDriver+0x5b
ffffc80b`34fef030 fffff801`bdfdb3a5 : ffffa685`b0624ac0 ffffc80b`34fef0d0 ffffa685`a05a4bf0 00000000`00000000 : nt!IofCallDriver+0x13
ffffc80b`34fef060 fffff801`bdfda1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffc80b`34fef110 fffff801`bdfd983e : 00000000`00000000 fffff801`bda3ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffc80b`34fef380 fffff801`bddcc558 : 00000000`00000000 00000000`00000000 0000000e`da776000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffc80b`34fef3f0 00007ffd`b8de1d84 : 00007ffd`aa833bc2 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000000e`dabfdca8 00007ffd`aa833bc2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtDeviceIoControlFile+0x14
0000000e`dabfdcb0 00007ffd`aa8331a1 : 00000000`00000000 0000000e`dabfdf80 00000000`00000000 00000000`00000000 : FLTLIB!FilterpDeviceIoControl+0x13e
0000000e`dabfdd20 00007ffd`a4503434 : 00000000`00000000 00000000`00000000 0000000e`dabfde70 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
0000000e`dabfdd70 00007ff7`9cb147fc : 00000000`00000000 00000000`00000000 ffffffff`ffffd8f0 00000000`00000000 : cldapi!CfQueryProgress+0x3f4
0000000e`dabfdf60 00000000`00000000 : 00000000`00000000 ffffffff`ffffd8f0 00000000`00000000 00000000`00000032 : poc+0x47fc
SYMBOL_NAME: cldflt!CldiStreamCompleteRequest+12f
MODULE_NAME: cldflt
IMAGE_NAME: cldflt.sys
STACK_COMMAND: .process /r /p 0xffffa685b001a080; .thread /r /p 0xffffa685ad7e7080 ; kb
BUCKET_ID_FUNC_OFFSET: 12f
FAILURE_BUCKET_ID: AV_VRF_cldflt!CldiStreamCompleteRequest
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {61f2862e-d255-0a0b-0f7e-ddec7a333e8f}
Followup: MachineOwner
---------
本文是原创文章，采用 CC BY-NC-ND 4.0 协议，完整转载请注明来自 程序员小航
阅读建议
评论
匿名评论
隐私政策
你无需删除空行，直接评论以获取最佳展示效果
最近发布
