Researcher Details Windows CLIP Service Vulnerabilities and Reverse-Engineering Methods

Summary

Philippe Laulheret explains how he reverse-engineered the Windows CLIP driver and found a license-signature bypass and kernel memory vulnerabilities. He says the reported bugs were fixed in July.

Key points

• The CLIP driver uses Warbird obfuscation, including self-modifying code, complicating static analysis and memory dumps.
• The researcher used emulation and analysis scripts to deobfuscate the driver and map its system-call interface.
• A license-parsing flaw allowed data appended after a signature to be processed without signature verification, enabling license fields to be forged.
• Device ID parsing contained kernel out-of-bounds reads and a double-fetch race that could potentially produce an out-of-bounds write.
• The researcher demonstrated winning the race under a debugger but said he did not have a complete exploit.
• The researcher reported the bugs to Microsoft and said they were fixed in July. He noted that the interface is reachable from a less-privileged application container.