TALOS-2026-2445 · cldflt.sys 类型混淆
CVE编号
CVE-2026-80093
摘要
Windows Cloud Files Mini Filter Driver 的 CldiStreamPrepareRequestForMoreProcessing 功能（版本：10.0.26100.8457 （WinBuild.160101.0800）和 10.0.26100.8655 （WinBuild.160101.0800））中存在一种类型混淆漏洞。专门设计的云过滤API调用序列可能导致类型混淆。攻击者可以执行专用应用程序来触发该漏洞。
已确认的易受攻击版本
以下版本要么经过Talos测试或验证存在漏洞，要么由厂商确认存在漏洞。
Windows Cloud Files Mini 过滤驱动（版本：10.0.26100.8457 （WinBuild.160101.0800） 和 10.0.26100.8655 （WinBuild.160101.0800））
产品网址
Windows Cloud 文件迷你过滤器驱动 - https://www.microsoft.com/
CVSSv3评分
8.8 - CVSS：3.1/AV：L/AC：L/PR：L/UI：N/S：C/C：H/I：H/A：H
CWE
CWE-843 - 使用不兼容类型访问资源（“类型混淆”）
详情
云文件迷你过滤器驱动（cldflt.sys）是一款Microsoft的Windows内核模式文件系统驱动程序，支持云存储集成功能，如OneDrive按需文件。它管理基于云的占位文件，同步本地存储与云服务之间的数据，并在用户访问文件时自动下载。该驱动程序在 Windows 文件系统堆栈中运行，使云文件表现得像普通本地文件。
当一个线程进入时，另一个线程执行 ，暂时将基于栈的哨兵插入同一侵入性请求列表时，就达到了易受攻击状态。中止步行器假设每个列表条目都嵌入在偏移量的对象中。如果它看到栈哨兵，计算如下：OpenStream->RequestListHeadCldStreamAbortOperationCldiStreamProcessPendingHydrationRequestsLIST_ENTRYCLD_STREAM_REQUEST_PARTIAL+0x8
request = CONTAINING_RECORD(entry,
CLD_STREAM_REQUEST_PARTIAL,
OpenStreamListEntry);
这等价于：
request = (CLD_STREAM_REQUEST_PARTIAL *)((char *)entry - 0x8);
对于哨兵条目，这会产生一个由另一线程内核栈支持的假请求对象。后续代码会从该假请求中取消引用字段，并通过假指针写入，导致内核崩溃，并可能提供写入原语，如果能影响假请求字段。QueueContext
要触发此条件，攻击者必须注册一个提供者并创建一个“脱水占位符”。 接下来，尝试读取该占位符会触发回调。如果提供者没有响应这个取数据请求，内核会创建一个与该占位符和流关联的待处理请求。 在请求待处理期间，攻击者可以调用其中一个未公开的API： 。 它通过通信端口向驱动发送消息，触发内核端的（）处理器。 顾名思义，该处理器负责操作和水分消除。在正常情况下，调用该函数的提供者或客户端会尝试取消与特定连接或同步根相关的特定请求。 不过，我们可以对相关字段使用类似万用符的值，并以以下方式调用：OnFetchDataCfAbortOperationcldflt\\CLDMSGPORTCldiPortProcessAbortHydration0x4002CfAbortOperation
/*
HRESULT CfAbortOperation(DWORD ProviderProcessId, CF_ABORT_PARAMS *pAbortParams, DWORD Flags)
struct CF_ABORT_PARAMS { // size: 0x20 (32 bytes)
__int64 ProviderKey; // +0x00
__int64 SyncRootKey; // +0x08
__int64 StreamKey; // +0x10
__int64 RequestKey; // +0x18
};
*/
HRESULT hr = pfnAbort(0, NULL, 0);
这导致了一种情景：调用方遍历所有连接、同步根、流表、流及其对应请求以中止它们。 在崩溃期间观察调用栈，我们可以看到以下函数调用：CldiPortProcessAbortHydration
For ProviderProcessId = 0, ProviderKey = 0 , SyncRootKey = 0 , StreamKey = 0 ,RequestKey = 0
� CldiPortNotifyMessage
� CldiPortProcessFilterControl
� CldiPortProcessAbortHydration - Iterates over Connections and related RootSync
� CldSyncAbortOperation - Iterates over StreamsTable for particular RootSync
� CldStreamAbortOperation - Iterates over StreamRequests for particular stream
� CldiStreamPrepareRequestForNonCdqCompletion
� CldiStreamPrepareRequestForMoreProcessing Keep in mind that when the abort procedure is called this way, it repeatedly walks all of these lists while trying to abort pending requests.
让我们聚焦于：CldStreamAbortOperation
Line 1 void __fastcall CldStreamAbortOperation(int ProcessId, PCLD_OPEN_STREAM_PARTIAL OpenStream, PVOID RequestKey)
Line 2 {
Line 3 currentSessionId = HsmOsGetProcessSessionIdFromEproccess(currentProcess);
Line 4 ...
Line 5
Line 6
Line 7 requestListHead = &OpenStream->RequestListHead;
Line 8 LABEL_9:
Line 9 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v10);
Line 10 for ( entry = requestListHead->Flink; entry != requestListHead; entry = *v16 )
Line 11 {
Line 12 request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
Line 13 if ( HsmOsIsInSameSession(ProcessSessionIdFromEproccess, (ULONG)entry[4].Blink, currentSessionId)
Line 14 && request->RequestorProcessId == ProcessId
Line 15 && (!RequestKey || RequestKey == request->RequestKeyOrSequence) )
Line 16 {
Line 17 LOBYTE(v17) = Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1();
Line 18 if ( v17 )
Line 19 {
Line 20 if ( !CldiStreamPrepareRequestForNonCdqCompletion(request) || !CldiCanDoNonCdqCompletion(request) )
Line 21 goto LABEL_18;
Line 22 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
Line 23 }
Line 24 else if ( !CldiStreamPrepareRequestForNonCdqCompletion(request) )
Line 25 {
Line 26 LABEL_18:
Line 27 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
Line 28 goto LABEL_9;
Line 29 }
Line 30 CldiStreamCompleteCanceledRequest(request, 0xC000CF16);
Line 31 goto LABEL_9;
Line 32 }
Line 33 }
Line 34 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v13);
Line 35 }
在内部，我们可以看到迭代请求列表时的循环：forlines 10-33
Line 7 requestListHead = &OpenStream->RequestListHead;
重要的是，在每次循环迭代中，都会有一个时间窗口，保护该列表的锁：
Line 9 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v10);
发布：
CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, v18);
这还带来了更多后果。
在对当前请求执行任何操作之前，必须满足若干条件。 从最后一个开始：lines 13-15
Line 15 && (!RequestKey || RequestKey == request->RequestKeyOrSequence) )
这是真的，因为我们设为 。 对于：RequestKey0
Line 14 && request->RequestorProcessId == ProcessId
该条件难以满足，因为我们设 ，通常不等于 。 那么我们是如何通过所有三个约束并执行几个额外功能的呢？ 在调用后，在内核线程中运行，并尝试通过反复遍历上述列表来中止请求，同时攻击者同时调用 。 调用该 API 会执行以下序列：ProcessId = 0RequestorProcessId0CfAbortOperationCldiPortProcessAbortHydrationCfDisconnectSyncRoot
USER-MODE : CfDisconnectSyncRoot
KERNEL:
� CldiPortNotifyMessage
� CldiPortProcessServiceCommands
� CldSyncDisconnectRootByObject
� CldiSyncTransferOrAckDataByObject
� CldStreamTransferData
� CldiStreamProcessPendingHydrationRequests
仔细观察，我们可以看到：CldiStreamProcessPendingHydrationRequests
Line 400 void __fastcall CldiStreamProcessPendingHydrationRequests(
Line 401 PCLD_OPEN_STREAM_PARTIAL OpenStream,
Line 402 PVOID AcquireContext,
Line 403 int AckDisposition,
Line 404 NTSTATUS CompletionStatus,
Line 405 LONGLONG TransferOffset,
Line 406 LONGLONG TransferLength,
Line 407 LONGLONG TransferBuffer)
Line 408 {
Line 409 LIST_ENTRY *p_RequestListHead; // r14
Line 410 LIST_ENTRY list_sentinel;
Line 411 ...
Line 412 list_sentinel.Blink = &list_sentinel;
Line 413 list_sentinel.Flink = &list_sentinel;
Line 414 p_RequestListHead = &OpenStream->RequestListHead;
Line 415 ...
Line 416 LABEL_2:
Line 417 CldiStreamCdqACQUIRE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, (PKIRQL)AcquireContext);
Line 418 if ( list_sentinel.Flink == &list_sentinel )
Line 419 {
Line 420 Blink = p_RequestListHead->Blink; // Temporarily appends a stack sentinel to the open-stream request list so the walker can restart safely after completion/reschedule mutates the list.
Line 421 if ( Blink->Flink != p_RequestListHead )
Line 422 goto LABEL_54;
Line 423 list_sentinel.Blink = p_RequestListHead->Blink;
Line 424 list_sentinel.Flink = p_RequestListHead;
Line 425 Blink->Flink = &list_sentinel;
Line 426 p_RequestListHead->Blink = &list_sentinel;
Line 427 }
Line 428 Flink = p_RequestListHead->Flink;
Line 429 while ( Flink != p_RequestListHead && Flink != &list_sentinel )
Line 430 {
Line 431 CompletionStatusa = SavedCompletionStatus;
Line 432 Request = CONTAINING_RECORD(Flink, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
(...)
Line 600 if ( v22 )
Line 601 {
Line 602 CldiStreamPrepareRequestForNonCdqCompletion((PCLD_STREAM_REQUEST_PARTIAL)&Flink[-1].Blink);
Line 603 LOBYTE(v24) = Feature_H2E_WPA3SAE__private_IsEnabledDeviceUsage_1();
Line 604 if ( v24 && !CldiCanDoNonCdqCompletion(&Flink[-1].Blink) )
Line 605 LABEL_47:
Line 606 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, HydrationOffset);
Line 607 else
Line 608 CldiStreamCompleteRequest(OpenStream, (PCLD_STREAM_REQUEST_PARTIAL)&Flink[-1].Blink, CompletionStatusa, 0);
Line 609 SavedAckDisposition = v36;
Line 610 SavedCompletionStatus = v37;
Line 611 goto LABEL_2; //restart iteration
Line 612 }
(...)
Line 700 if ( list_sentinel.Flink != &list_sentinel )
Line 701 {
Line 702 v26 = list_sentinel.Blink;
Line 703 if ( list_sentinel.Flink->Blink != &list_sentinel
Line 704 || (HydrationOffset = (LONGLONG)&list_sentinel, list_sentinel.Blink->Flink != &list_sentinel) )
Line 705 {
Line 706 LABEL_54:
Line 707 __fastfail(3u);
Line 708 }
Line 709 list_sentinel.Blink->Flink = list_sentinel.Flink;
Line 710 v25->Blink = v26;
Line 711 list_sentinel.Blink = &list_sentinel;
Line 712 list_sentinel.Flink = &list_sentinel;
Line 713 }
Line 714 CldiStreamCdqRELEASE(&OpenStream->StreamContext->InstanceContext->CallbackDataQueue, HydrationOffset);
Line 715 }
我们首先注意到的是，它也遍历了与以下相同的请求列表：CldiStreamProcessPendingHydrationRequestsCldStreamAbortOperation
Line 414 p_RequestListHead = &OpenStream->RequestListHead;
我们还可以看到一个在前述函数中没有的特殊元素：在 中插入了一个特殊元素。这似乎起到了列表的哨兵作用。 会走动当前请求列表，但走动过程中可能会完成、取消链接、重新安排或以其他方式移动当前请求。 其中一些操作还能释放并重新获得CBDQ锁。 这意味着正常的迭代状态不稳定：当前条目可能消失，可能不再安全使用，且在函数仍在执行时可能插入新请求。 因此，该函数在 的尾部附近插入一个栈哨兵。然后它从列表头开始，直到到达真正的列表头或这个临时哨兵。 概念上：OpenStream->RequestListHeadlines 418-427CldiStreamProcessPendingHydrationRequestsFlinkLIST_ENTRYOpenStream->RequestListHead
RequestListHead -> req1 -> req2 -> req3 -> sentinel -> head
哨兵解决了三个实际问题：
它避免在当前请求完成或移动后使用过期。
Flink它允许函数在丢弃并重新获取队列锁后安全重启。
它防止新插入或重新排队的工作无限延长当前通道。
然而，这里有个问题。如在 处所示，锁可以被释放，环路可以在 处重新开始。在这个短暂的窗口内，锁被释放时，与 相关的线程可以获得相同的锁并遍历同一列表（）。 不认识该对象，并像对待其他对象一样对待，试图获取指向流请求的指针：line 606whileline 611CldStreamAbortOperationOpenStream->RequestListHeadCldStreamAbortOperationLIST_ENTRY list_sentinelLIST_ENTRY
Line 12 request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
由于 偏移量为 ，因此得到：OpenStreamListEntry0x8
fake_request = sentinel - 0x8
这会导致类型混淆，因为 只是局部栈变量，而不是对象的一部分字段。list_sentinelOpenStreamListEntryCLD_STREAM_REQUEST_PARTIAL
为了证明这个理论，让我们来探讨“崩溃倾倒”。
0: kd> .cxr 0xffffc60a9218e170 ; kb
rax=01dcf7310e592844 rbx=ffffc60a91c7e908 rcx=00000000c000cf01
rdx=0000000000000000 rsi=ffffa487d6a92f90 rdi=ffffc60a91c7e908
rip=fffff80f76f0a7cf rsp=ffffc60a9218eba0 rbp=0000000000000001
r8=0000000000000001 r9=ffffc60a91c7e910 r10=fffff806e164c190
r11=ffffc60a9218eb98 r12=0000000000000000 r13=0000000000000090
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47:
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax ds:002b:00000000`c000cf29=????????????????
*** Stack trace for last set context - .thread/.cxr resets it
# RetAddr : Args to Child : Call Site
00 fffff80f`76f110d1 : 00000000`00000000 ffffa487`d6a92f80 00000000`00000090 00000000`00000000 : cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
01 fffff80f`76f3f7fb : ffffc60a`91c7e908 fffff806`e2242e80 fffff806`e16d06d0 fffff806`72f42a26 : cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
02 fffff80f`76f3c448 : ffffa487`d6a6efa0 00000000`00000000 ffffa487`d6a9ef88 ffff918f`45df0958 : cldflt!CldStreamAbortOperation+0x123
03 fffff80f`76f3a045 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldSyncAbortOperation+0x108
04 fffff80f`76f7b232 : 00000000`00004002 00000000`00000001 00000001`00000000 ffffa487`bd8b2fd0 : cldflt!CldiPortProcessAbortHydration+0x599
05 fffff80f`76f4af49 : 00000000`00004002 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x76
06 fffff806`72f43622 : ffffa487`d6a42ee0 000000f2`a32ff9a0 00000000`0000016c 000000f2`a32ff960 : cldflt!CldiPortNotifyMessage+0xcc9
07 fffff806`72f8f632 : ffff918f`46e61490 000000f2`a32ff9a0 ffff918f`46e61560 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
08 fffff806`72f4b9c3 : ffff918f`46e61490 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
09 fffff806`e167ccfb : 918f4471`c430fffe 00000000`00060000 ffff918f`4471c460 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
0a fffff806`e167cc73 : ffff918f`4471c460 ffff918f`4471c460 00000000`00000000 ffff918f`45df0958 : nt!IopfCallDriver+0x5b
0b fffff806`e1ceb3a5 : ffff918f`4471c460 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
0c fffff806`e1cea1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
0d fffff806`e1ce983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
0e fffff806`e1adc558 : 00000000`00000001 000000f2`a32fe200 ffffc60a`9218f4e0 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
0f 00007ffa`37901d84 : 00007ffa`2a293bc2 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x28
10 00007ffa`2a293bc2 : 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 00000000`00000060 : ntdll!NtDeviceIoControlFile+0x14
11 00007ffa`2a2931a1 : 00000000`000000c8 00000000`00000000 00000000`000000bc 00000000`00000014 : FLTLIB!FilterpDeviceIoControl+0x13e
12 00007ff6`16c14249 : 000001f6`d43c0000 00000000`00000048 00000000`00000470 00007ffa`377c8771 : FLTLIB!FilterSendMessage+0x31
13 000001f6`d43c0000 : 00000000`00000048 00000000`00000470 00007ffa`377c8771 000001f6`00000040 : abort_type_confusion+0x4249
Line 900 BOOLEAN __fastcall CldiStreamPrepareRequestForMoreProcessing(CLD_STREAM_REQUEST_PARTIAL *Request)
Line 901 {
Line 902 __int64 Now100ns; // rax
Line 903 _QWORD *QueueContext; // rcx
Line 904
Line 905 KeEnterCriticalRegion();
Line 906 ExAcquireResourceExclusiveLite(&g_CrossVmNotificationResource, 1u);
Line 907 Now100ns = MEMORY[0xFFFFF78000000014];
Line 908 QueueContext = Request->QueueContext;
Line 909 Request->PreparedSystemTime100ns = MEMORY[0xFFFFF78000000014];
Line 910 if ( QueueContext )
Line 911 QueueContext[5] = Now100ns; // CRASH!!!
我们看到尝试将RAX值写入存储在RCX中的地址（加，对应于）。 看起来是错误代码。 是从假请求对象中被取消引用的字段。指向虚假请求的指针在寄存器中。让我们看看它的位置：00000000c000cf010x28line 91100000000c000cf01STATUS_CLOUD_FILE_PROVIDER_NOT_RUNNINGQueueContextRBX
0: kd> !address ffffc60a91c7e908
Usage: Stack
Base Address: ffffc60a`91c79000
End Address: ffffc60a`91c80000
Region Size: 00000000`00007000
VA Type: SystemRange
真实请求应位于池内存或备用内存中，而非堆栈中。 通过检查内核中现有的 -相关线程，我们可以看到：cldflt
!stacks 2 cldflt
(...)
[ffff918f4ab240c0 abort_type_confusion.]
6b4.0011bc ffff918f3f2a9080 0000000 Blocked nt!KiSwapContext+0x76
nt!KiSwapThread+0x6d4
nt!KiCommitThreadWait+0x39d
nt!KeWaitForSingleObject+0x859
nt!ExpWaitForResource+0x72
nt!ExAcquireResourceExclusiveLite+0x5e4
cldflt!CldiStreamCdqACQUIRE+0x2a
cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
cldflt!CldStreamTransferData+0x54c
cldflt!CldiSyncTransferOrAckDataByObject+0x487
cldflt!CldSyncDisconnectRootByObject+0x266
cldflt!CldSyncDisconnectRoot+0x136
cldflt!CldiPortProcessServiceCommands+0x1456
cldflt!CldiPortNotifyMessage+0xaba
FLTMGR!FltpFilterMessage+0x162
FLTMGR!FltpMsgDispatch+0xf2
FLTMGR!FltpDispatch+0x133
nt!IopfCallDriver+0x5b
nt!IofCallDriver+0x13
nt!IopSynchronousServiceTail+0x1c5
nt!IopXxxControlFile+0x99c
nt!NtDeviceIoControlFile+0x5e
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtDeviceIoControlFile+0x14
[ffff918f3ba930c0 abort_type_confusion.]
21d8.000850 ffff918f45df0080 0000000 RUNNING nt!DbgBreakPointWithStatus
nt!KiBugCheckDebugBreak+0x12
nt!KeBugCheck2+0xb2e
nt!KeBugCheckEx+0x107
nt!KiBugCheckDispatch+0x69
nt!KiSystemServiceHandler+0x7c
nt!RtlpExecuteHandlerForException+0x12
nt!RtlDispatchException+0x2d2
nt!KiDispatchException+0x35f
nt!KiExceptionDispatch+0x145
nt!KiPageFault+0x442
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
cldflt!CldStreamAbortOperation+0x123
cldflt!CldSyncAbortOperation+0x108
cldflt!CldiPortProcessAbortHydration+0x599
cldflt!CldiPortProcessFilterControl+0x76
cldflt!CldiPortNotifyMessage+0xcc9
FLTMGR!FltpFilterMessage+0x162
FLTMGR!FltpMsgDispatch+0xf2
FLTMGR!FltpDispatch+0x133
nt!IopfCallDriver+0x5b
nt!IofCallDriver+0x13
nt!IopSynchronousServiceTail+0x1c5
nt!IopXxxControlFile+0x99c
nt!NtDeviceIoControlFile+0x5e
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtDeviceIoControlFile+0x14
FLTLIB!FilterpDeviceIoControl+0x13e
FLTLIB!FilterSendMessage+0x31
abort_type_confusion+0x4249
通过检查调用 所创建线程的栈范围地址，我们看到：CfDisconnectSyncRoot
0: kd> !thread ffff918f3f2a9080
THREAD ffff918f3f2a9080 Cid 06b4.11bc Teb: 000000464101e000 Win32Thread: 0000000000000000 WAIT: (WrResource) KernelMode Non-Alertable
ffffc60a91c7e7d8 SynchronizationEvent
IRP List:
ffff918f46531480: (0006,0118) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap ffffa487d64771d0
Owning Process ffff918f4ab240c0 Image: abort_type_confusion.exe
Attached Process N/A Image: N/A
Wait Start TickCount 216903 Ticks: 0
Context Switch Count 70 IdealProcessor: 2
UserTime 00:00:00.015
KernelTime 00:00:00.046
Win32 Start Address abort_type_confusion (0x00007ff616c1615c)
Stack Init ffffc60a91c7f5f0 Current ffffc60a91c7e350
Base ffffc60a91c80000 Limit ffffc60a91c79000 Call 0000000000000000 // < --- IMPORTANT VALUES
Priority 8 BasePriority 8 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffffc60a`91c7e390 fffff806`e169e424 : 00000000`00000047 00000000`00000000 00000000`00000000 ffff8080`43f1e2b0 : nt!KiSwapContext+0x76
ffffc60a`91c7e4d0 fffff806`e1751dcd : 00000000`00000000 00000000`00000000 ffffc60a`91c7e660 fffff80f`00000017 : nt!KiSwapThread+0x6d4
ffffc60a`91c7e560 fffff806`e174ffc9 : ffffa487`00000000 00000000`00000002 00000007`00000017 00000007`e45dcdab : nt!KiCommitThreadWait+0x39d
ffffc60a`91c7e5f0 fffff806`e164d082 : ffffc60a`91c7e7d8 ffff918f`0000001b 00000000`00000000 0000ff00`00000000 : nt!KeWaitForSingleObject+0x859
ffffc60a`91c7e6d0 fffff806`e164c774 : ffff918f`42a84f90 ffffc60a`91c7e7c0 ffff918f`00010224 00000000`00000006 : nt!ExpWaitForResource+0x72
ffffc60a`91c7e760 fffff80f`76f4a06a : 00000000`00000000 00000000`00000004 00000000`00000000 ffffa487`d6a92f90 : nt!ExAcquireResourceExclusiveLite+0x5e4
ffffc60a`91c7e870 fffff80f`76f72c73 : fffff80f`76f86300 ffffa487`c459fe00 ffffa487`d6979870 ffffa487`00000000 : cldflt!CldiStreamCdqACQUIRE+0x2a
ffffc60a`91c7e8a0 fffff80f`76f720d0 : 01dcf731`0e592844 00400000`00046f40 00000000`00000004 00000000`c000cf01 : cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
ffffc60a`91c7e990 fffff80f`76f71afb : ffffa487`d6a92f80 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldStreamTransferData+0x54c
ffffc60a`91c7eac0 fffff80f`76f4c6aa : ffffa487`d6a6efa0 ffffa487`00000000 ffffa487`c000cf01 ffffa487`d6a6efa0 : cldflt!CldiSyncTransferOrAckDataByObject+0x487
ffffc60a`91c7eb80 fffff80f`76f831ea : 00000000`00000000 00000000`00000000 00000209`a10611b0 ffff918f`42a84e80 : cldflt!CldSyncDisconnectRootByObject+0x266
ffffc60a`91c7ebe0 fffff80f`76f82f0e : 00140000`0002a31c 00140000`0002a31c ffffc60a`91c7ecf9 00000000`c0000225 : cldflt!CldSyncDisconnectRoot+0x136
ffffc60a`91c7ec40 fffff80f`76f4ad3a : ffffa487`d6a5aee0 00000000`00000001 00000000`00000005 00000000`000000e8 : cldflt!CldiPortProcessServiceCommands+0x1456
ffffc60a`91c7ed60 fffff806`72f43622 : ffffa487`d6a5aee0 00000209`a1057aa0 00000000`000000e8 00000000`00000000 : cldflt!CldiPortNotifyMessage+0xaba
ffffc60a`91c7ee70 fffff806`72f8f632 : ffff918f`46531480 00000209`a1057aa0 ffff918f`46531550 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
ffffc60a`91c7eee0 fffff806`72f4b9c3 : ffff918f`46531480 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
ffffc60a`91c7ef50 fffff806`e167ccfb : 00000000`00000001 00000000`00060000 ffff918f`4710d230 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
ffffc60a`91c7eff0 fffff806`e167cc73 : ffff918f`4710d230 ffff918f`4710d230 00000000`00000000 ffff918f`3f2a9958 : nt!IopfCallDriver+0x5b
ffffc60a`91c7f030 fffff806`e1ceb3a5 : ffff918f`4710d230 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
ffffc60a`91c7f060 fffff806`e1cea1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffc60a`91c7f110 fffff806`e1ce983e : 00000000`00000000 fffff806`e174ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffc60a`91c7f380 fffff806`e1adc558 : 00000000`0000001c 00000000`00000001 00000046`4101e000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffc60a`91c7f3f0 00007ffa`37901d84 : 00007ffa`2a293bc2 00000000`00000000 00000000`00000000 00007ff6`16c3f158 : nt!KiSystemServiceCopyEnd+0x28 (TrapFrame @ ffffc60a`91c7f460)
00000046`412eed48 00007ffa`2a293bc2 : 00000000`00000000 00000000`00000000 00007ff6`16c3f158 00000000`00000002 : ntdll!NtDeviceIoControlFile+0x14
00000046`412eed50 00007ffa`2a2931a1 : 00000209`a10611b0 0000e2d7`8ef3dbff 00000209`a1057aa0 00000209`a10611b0 : FLTLIB!FilterpDeviceIoControl+0x13e
00000046`412eedc0 00007ffa`208472c2 : 00000209`00000000 00000000`00000000 00000046`412eee89 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
00000046`412eee10 00007ff6`16c13f22 : 00000209`00000000 00000007`e411826b ffffffff`ff676980 00000209`a1069868 : cldapi!CfDisconnectSyncRoot+0x3e2
00000046`412eeef0 00000209`00000000 : 00000007`e411826b ffffffff`ff676980 00000209`a1069868 00000000`00000000 : abort_type_confusion+0x3f22
这确认了 RBX 值指向与该线程相关的堆栈内存。 切换到那个话题：
0: kd> .thread /r /p ffff918f3f2a9080
Implicit thread is now ffff918f`3f2a9080
Implicit process is now ffff918f`4ab240c0
Loading User Symbols
.............
0: kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
# RetAddr : Args to Child : Call Site
00 fffff806`e169e424 : 00000000`00000047 00000000`00000000 00000000`00000000 ffff8080`43f1e2b0 : nt!KiSwapContext+0x76
01 fffff806`e1751dcd : 00000000`00000000 00000000`00000000 ffffc60a`91c7e660 fffff80f`00000017 : nt!KiSwapThread+0x6d4
02 fffff806`e174ffc9 : ffffa487`00000000 00000000`00000002 00000007`00000017 00000007`e45dcdab : nt!KiCommitThreadWait+0x39d
03 fffff806`e164d082 : ffffc60a`91c7e7d8 ffff918f`0000001b 00000000`00000000 0000ff00`00000000 : nt!KeWaitForSingleObject+0x859
04 fffff806`e164c774 : ffff918f`42a84f90 ffffc60a`91c7e7c0 ffff918f`00010224 00000000`00000006 : nt!ExpWaitForResource+0x72
05 fffff80f`76f4a06a : 00000000`00000000 00000000`00000004 00000000`00000000 ffffa487`d6a92f90 : nt!ExAcquireResourceExclusiveLite+0x5e4
06 fffff80f`76f72c73 : fffff80f`76f86300 ffffa487`c459fe00 ffffa487`d6979870 ffffa487`00000000 : cldflt!CldiStreamCdqACQUIRE+0x2a
07 fffff80f`76f720d0 : 01dcf731`0e592844 00400000`00046f40 00000000`00000004 00000000`c000cf01 : cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
08 fffff80f`76f71afb : ffffa487`d6a92f80 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldStreamTransferData+0x54c
09 fffff80f`76f4c6aa : ffffa487`d6a6efa0 ffffa487`00000000 ffffa487`c000cf01 ffffa487`d6a6efa0 : cldflt!CldiSyncTransferOrAckDataByObject+0x487
0a fffff80f`76f831ea : 00000000`00000000 00000000`00000000 00000209`a10611b0 ffff918f`42a84e80 : cldflt!CldSyncDisconnectRootByObject+0x266
0b fffff80f`76f82f0e : 00140000`0002a31c 00140000`0002a31c ffffc60a`91c7ecf9 00000000`c0000225 : cldflt!CldSyncDisconnectRoot+0x136
0c fffff80f`76f4ad3a : ffffa487`d6a5aee0 00000000`00000001 00000000`00000005 00000000`000000e8 : cldflt!CldiPortProcessServiceCommands+0x1456
0d fffff806`72f43622 : ffffa487`d6a5aee0 00000209`a1057aa0 00000000`000000e8 00000000`00000000 : cldflt!CldiPortNotifyMessage+0xaba
0e fffff806`72f8f632 : ffff918f`46531480 00000209`a1057aa0 ffff918f`46531550 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
0f fffff806`72f4b9c3 : ffff918f`46531480 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
10 fffff806`e167ccfb : 00000000`00000001 00000000`00060000 ffff918f`4710d230 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
11 fffff806`e167cc73 : ffff918f`4710d230 ffff918f`4710d230 00000000`00000000 ffff918f`3f2a9958 : nt!IopfCallDriver+0x5b
12 fffff806`e1ceb3a5 : ffff918f`4710d230 ffffc60a`91c7f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
13 fffff806`e1cea1ec : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
14 fffff806`e1ce983e : 00000000`00000000 fffff806`e174ce9f 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
15 fffff806`e1adc558 : 00000000`0000001c 00000000`00000001 00000046`4101e000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
16 00007ffa`37901d84 : 00007ffa`2a293bc2 00000000`00000000 00000000`00000000 00007ff6`16c3f158 : nt!KiSystemServiceCopyEnd+0x28
17 00007ffa`2a293bc2 : 00000000`00000000 00000000`00000000 00007ff6`16c3f158 00000000`00000002 : ntdll!NtDeviceIoControlFile+0x14
18 00007ffa`2a2931a1 : 00000209`a10611b0 0000e2d7`8ef3dbff 00000209`a1057aa0 00000209`a10611b0 : FLTLIB!FilterpDeviceIoControl+0x13e
19 00007ffa`208472c2 : 00000209`00000000 00000000`00000000 00000046`412eee89 00000000`00000000 : FLTLIB!FilterSendMessage+0x31
1a 00007ff6`16c13f22 : 00000209`00000000 00000007`e411826b ffffffff`ff676980 00000209`a1069868 : cldapi!CfDisconnectSyncRoot+0x3e2
1b 00000209`00000000 : 00000007`e411826b ffffffff`ff676980 00000209`a1069868 00000000`00000000 : abort_type_confusion+0x3f22
并将框架改为：
0: kd> .frame /r 0n7;dv /t /v
07 ffffc60a`91c7e8a0 fffff80f`76f720d0 cldflt!CldiStreamProcessPendingHydrationRequests+0x6b
rax=0000000000000000 rbx=00000000c000cf01 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000004
rip=fffff80f76f72c73 rsp=ffffc60a91c7e8a0 rbp=ffffc60a91c7e941
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=ffffa487d6979878 r13=0000000000000000
r14=ffffa487d6a92f90 r15=ffffa487d6a92f80
iopl=0 nv up di pl nz na po nc
cs=0000 ss=0000 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
cldflt!CldiStreamProcessPendingHydrationRequests+0x6b:
fffff80f`76f72c73 488d45cf lea rax,[rbp-31h]
我们可以根据IDA提供的信息解读哨兵地址：
LIST_ENTRY list_sentinel; // [rsp+78h] [rbp-31h] BYREF
0: kd> ?ffffc60a91c7e941-0x31 -8
Evaluate expression: -63726278940408 = ffffc60a`91c7e908
计算包括：- 8
request = CONTAINING_RECORD(entry, CLD_STREAM_REQUEST_PARTIAL, OpenStreamListEntry);
request = (char *)entry - 0x8;
这就是宏如何获得该结构中请求对象的指针。CONTAINING_RECORD
利用这些信息，攻击者可能会尝试使用通往调用的不同执行路径，利用由此产生的类型混淆，以更好地控制虚假请求对象的字段。 这可能导致任意写入，最终导致任意代码执行。CldiStreamProcessPendingHydrationRequests
事故信息
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80f76f0a7cf, Address of the instruction which caused the BugCheck
Arg3: ffffc60a9218e170, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1765
Key : Analysis.Elapsed.mSec
Value: 3060
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 37
Key : Analysis.IO.Write.Mb
Value: 27
Key : Analysis.Init.CPU.mSec
Value: 42578
Key : Analysis.Init.Elapsed.mSec
Value: 79732706
Key : Analysis.Memory.CommitPeak.Mb
Value: 168
Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002
Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre
Key : Analysis.Version.Ext
Value: 1.2602.27.2
Key : Bugcheck.Code.KiBugCheckData
Value: 0x3b
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Bugcheck.Code.TargetModel
Value: 0x3b
Key : Failure.Bucket
Value: AV_VRF_cldflt!CldiStreamPrepareRequestForMoreProcessing
Key : Failure.Exception.IP.Address
Value: 0xfffff80f76f0a7cf
Key : Failure.Exception.IP.Module
Value: cldflt
Key : Failure.Exception.IP.Offset
Value: 0xa7cf
Key : Failure.Hash
Value: {4129a4d8-43d0-209f-5056-9e4af3e36ca6}
Key : Faulting.IP.Type
Value: Paged
Key : Hypervisor.Enlightenments.ValueHex
Value: 0x6090ebf4
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 1
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 659693
Key : Hypervisor.Flags.ValueHex
Value: 0xa10ed
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 1
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0x0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
Key : WER.System.BIOSRevision
Value: 4.1.0.0
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80f76f0a7cf
BUGCHECK_P3: ffffc60a9218e170
BUGCHECK_P4: 0
FILE_IN_CAB: full.dmp
VIRTUAL_MACHINE: HyperV
FAULTING_THREAD: ffff918f45df0080
CONTEXT: ffffc60a9218e170 -- (.cxr 0xffffc60a9218e170)
rax=01dcf7310e592844 rbx=ffffc60a91c7e908 rcx=00000000c000cf01
rdx=0000000000000000 rsi=ffffa487d6a92f90 rdi=ffffc60a91c7e908
rip=fffff80f76f0a7cf rsp=ffffc60a9218eba0 rbp=0000000000000001
r8=0000000000000001 r9=ffffc60a91c7e910 r10=fffff806e164c190
r11=ffffc60a9218eb98 r12=0000000000000000 r13=0000000000000090
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47:
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax ds:002b:00000000`c000cf29=????????????????
Resetting default scope
PROCESS_NAME: abort_type_confusion.exe
IP_IN_PAGED_CODE:
cldflt!CldiStreamPrepareRequestForMoreProcessing+47
fffff80f`76f0a7cf 48894128 mov qword ptr [rcx+28h],rax
STACK_TEXT:
ffffc60a`9218eba0 fffff80f`76f110d1 : 00000000`00000000 ffffa487`d6a92f80 00000000`00000090 00000000`00000000 : cldflt!CldiStreamPrepareRequestForMoreProcessing+0x47
ffffc60a`9218ebd0 fffff80f`76f3f7fb : ffffc60a`91c7e908 fffff806`e2242e80 fffff806`e16d06d0 fffff806`72f42a26 : cldflt!CldiStreamPrepareRequestForNonCdqCompletion+0x19
ffffc60a`9218ec00 fffff80f`76f3c448 : ffffa487`d6a6efa0 00000000`00000000 ffffa487`d6a9ef88 ffff918f`45df0958 : cldflt!CldStreamAbortOperation+0x123
ffffc60a`9218ec50 fffff80f`76f3a045 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldSyncAbortOperation+0x108
ffffc60a`9218ecb0 fffff80f`76f7b232 : 00000000`00004002 00000000`00000001 00000001`00000000 ffffa487`bd8b2fd0 : cldflt!CldiPortProcessAbortHydration+0x599
ffffc60a`9218ed30 fffff80f`76f4af49 : 00000000`00004002 00000000`00000000 00000000`00000000 00000000`00000000 : cldflt!CldiPortProcessFilterControl+0x76
ffffc60a`9218ed60 fffff806`72f43622 : ffffa487`d6a42ee0 000000f2`a32ff9a0 00000000`0000016c 000000f2`a32ff960 : cldflt!CldiPortNotifyMessage+0xcc9
ffffc60a`9218ee70 fffff806`72f8f632 : ffff918f`46e61490 000000f2`a32ff9a0 ffff918f`46e61560 00000000`00000000 : FLTMGR!FltpFilterMessage+0x162
ffffc60a`9218eee0 fffff806`72f4b9c3 : ffff918f`46e61490 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : FLTMGR!FltpMsgDispatch+0xf2
ffffc60a`9218ef50 fffff806`e167ccfb : 918f4471`c430fffe 00000000`00060000 ffff918f`4471c460 fffff806`e1c661b9 : FLTMGR!FltpDispatch+0x133
ffffc60a`9218eff0 fffff806`e167cc73 : ffff918f`4471c460 ffff918f`4471c460 00000000`00000000 ffff918f`45df0958 : nt!IopfCallDriver+0x5b
ffffc60a`9218f030 fffff806`e1ceb3a5 : ffff918f`4471c460 ffffc60a`9218f0d0 ffff918f`3b5a3bf0 00000000`00000000 : nt!IofCallDriver+0x13
ffffc60a`9218f060 fffff806`e1cea1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffc60a`9218f110 fffff806`e1ce983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffc60a`9218f380 fffff806`e1adc558 : 00000000`00000001 000000f2`a32fe200 ffffc60a`9218f4e0 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffc60a`9218f3f0 00007ffa`37901d84 : 00007ffa`2a293bc2 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x28
000000f2`a32ff858 00007ffa`2a293bc2 : 000001f6`d43cb2e0 00000000`00000007 00000000`00000010 00000000`00000060 : ntdll!NtDeviceIoControlFile+0x14
000000f2`a32ff860 00007ffa`2a2931a1 : 00000000`000000c8 00000000`00000000 00000000`000000bc 00000000`00000014 : FLTLIB!FilterpDeviceIoControl+0x13e
000000f2`a32ff8d0 00007ff6`16c14249 : 000001f6`d43c0000 00000000`00000048 00000000`00000470 00007ffa`377c8771 : FLTLIB!FilterSendMessage+0x31
000000f2`a32ff920 000001f6`d43c0000 : 00000000`00000048 00000000`00000470 00007ffa`377c8771 000001f6`00000040 : abort_type_confusioin+0x4249
SYMBOL_NAME: cldflt!CldiStreamPrepareRequestForMoreProcessing+47
MODULE_NAME: cldflt
IMAGE_NAME: cldflt.sys
STACK_COMMAND: .cxr 0xffffc60a9218e170 ; kb
BUCKET_ID_FUNC_OFFSET: 47
FAILURE_BUCKET_ID: AV_VRF_cldflt!CldiStreamPrepareRequestForMoreProcessing
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4129a4d8-43d0-209f-5056-9e4af3e36ca6}
Followup: MachineOwner
---------
本文是原创文章，采用 CC BY-NC-ND 4.0 协议，完整转载请注明来自 程序员小航
阅读建议
评论
匿名评论
隐私政策
你无需删除空行，直接评论以获取最佳展示效果
最近发布
