Finding vulnerabilities in ClipSp, the driver at the core of Windows’ Client License Platform

Category	Details
Threat Actors	Not explicitly mentioned.
Campaign Overview	Research on vulnerabilities in the ClipSp driver, which implements client licensing and system policies in Windows 10 and 11. Vulnerabilities range from signature bypass to privilege escalation and sandbox escape.
Target Regions	Global, with potential impact on any system running Windows 10 or 11.
Methodology	Exploitation of vulnerabilities in the ClipSp driver through obfuscated structures, signature bypass, and memory corruption issues.
Product Targeted	Microsoft Windows 10 and 11 systems, particularly the ClipSp driver used in licensing and policy management.
Malware Reference	Not applicable; no specific malware is mentioned.
Tools Used	Qiling binary emulation framework, IDA Pro with Python for reverse engineering, Microsoft’s LPAC sandbox testing tool.
Vulnerabilities Exploited	Eight vulnerabilities identified: TALOS-2024-1964 to TALOS-2024-1988 (e.g., CVE-2024-38184, CVE-2024-38185). Key issues include signature bypass, out-of-bound reads, and potential out-of-bound writes.
TTPs	Reverse engineering obfuscated drivers; exploiting design flaws in license verification, encryption routines, and memory management.
Attribution	Cisco Talos research team.
Recommendations	Patch affected systems once updates are available; monitor ClipSp driver usage and implement additional checks for critical systems; evaluate potential exposure to sandbox escape and privilege escalation scenarios.
Source	Cisco Talos Blog

Read full article: https://blog.talosintelligence.com/finding-vulnerabilities-in-clipsp-the-driver-at-the-core-of-windows-client-license-platform/

Disclaimer: The above summary has been generated by an AI language model