MiniPlasma — The Ghost Patch: A 5-Year-Old Windows LPE That Never Died

TL;DR

MiniPlasma is a Windows local privilege escalation exploit that achieves standard user → SYSTEM on fully patched Windows 11 systems (including the May 2026 Patch Tuesday updates). The jaw-dropper? It targets the exact same vulnerability that Google Project Zero reported in September 2020 and Microsoft claimed to fix in December 2020.

• CVE: CVE-2020-17103 (CVSS 7.0) — supposedly patched
• Component: cldflt.sys — Windows Cloud Files Minifilter driver
• Flaw: TOCTOU race condition in HsmOsBlockPlaceholderAccess
• Impact: Full SYSTEM shell from standard user
• Affected: All Windows versions (confirmed on Win11 with May 2026 updates)
• Not affected: Latest Windows 11 Insider Preview Canary builds (suggests a fix may be incoming)
• Researcher: Chaotic Eclipse / Nightmare-Eclipse
• Public PoC: github.com/Nightmare-Eclipse/MiniPlasma

The Ghost Patch Problem

In cybersecurity, few things are more unsettling than a patch that never actually landed. That’s exactly what happened here.

Google Project Zero researcher James Forshaw reported a privilege escalation vulnerability in the Windows Cloud Filter driver (cldflt.sys) in September 2020. The flaw allowed an attacker to manipulate registry keys via an undocumented CfAbortHydration API — creating keys in the .DEFAULT user hive without proper access checks. Microsoft assigned it CVE-2020-17103, shipped a fix in the December 2020 Patch Tuesday, and everyone moved on.

Except the fix didn’t stick. Or maybe it was never there to begin with.

Chaotic Eclipse’s discovery:

“After investigating, it turns out the exact same issue that was reported to Microsoft by Google Project Zero is actually still present, unpatched. I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons. The original PoC by Google worked without any changes.”

The original 2020 proof-of-concept works today. Zero modifications. That’s five and a half years of a critical LPE sitting open on every Windows machine.

How It Works: The TOCTOU Race

MiniPlasma exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition in how the Cloud Filter driver handles placeholder file creation:

The Vulnerable Path

1. User calls CfCreatePlaceholders() — This is the legitimate Cloud Files API for sync engines like OneDrive to create placeholder files/directories under a sync root.

2. HsmpOpCreatePlaceholders() validates the filename — The driver checks the user-provided filename for dangerous characters like \ and :. This is the check.

3. The race window opens — Between the filename validation and the actual call to FltCreateFileEx2() to create the file, there’s a window where the user-mode buffer can be modified.

4. Attacker swaps the filename — By changing the buffer contents after validation but before file creation, the attacker can create files or directories anywhere on the system — including the .DEFAULT registry hive.

5. Registry key creation → privilege escalation — Arbitrary key creation in the .DEFAULT hive leads to full SYSTEM code execution.

What Makes This Different From GreenPlasma?

While both target cldflt.sys, they exploit different routines:

The critical distinction: MiniPlasma exploits a vulnerability that was supposedly fixed over five years ago. GreenPlasma was always unpatched.

The Broader Context: Chaotic Eclipse’s Campaign

MiniPlasma is the sixth zero-day from Chaotic Eclipse in a disclosure campaign fueled by disputes with Microsoft’s vulnerability handling:

The researcher has been explicit about their motivation:

“Normally, I would go through the process of begging them to fix a bug but to summarize, I was told personally by them that they will ruin my life and they did… They mopped the floor with me and pulled every childish game they could.”

Whether you agree with full-disclosure-as-protest or not, the pattern is clear: Microsoft’s bug bounty program and MSRC process are pushing researchers toward public release instead of coordinated disclosure.

Technical Deep Dive: The Exodus Intelligence Connection

Exodus Intelligence published an excellent technical analysis of a related TOCTOU flaw in cldflt.sys (CVE-2025-55680, patched October 2025). While that’s a different vulnerability in the same driver, their writeup provides crucial context for understanding the attack surface:

The Cloud Files Attack Surface

The cldflt.sys driver is loaded by default on all modern Windows systems (it powers OneDrive’s files-on-demand feature). It registers callbacks for major I/O operations:

• IRP_MJ_CREATE — File/directory creation
• IRP_MJ_FILE_SYSTEM_CONTROL — Handles custom IOCTL 0x903BC for cloud operations
• Plus read, write, lock, query, and set information callbacks

The driver processes custom IOCTLs through HsmFltPreFILE_SYSTEM_CONTROL() and HsmFltPostFILE_SYSTEM_CONTROL(). When OpType is 0xC0000001, it triggers CfCreatePlaceholders() — the exact path MiniPlasma targets.

Why TOCTOU Bugs Are Hard to Fix

Race conditions in kernel drivers are notoriously difficult to patch correctly because:

1. The window can be widened — Attackers can use techniques like thread suspension, priority manipulation, or memory pressure to stretch the race window.
2. Patches often address the symptom, not the root cause — Blocking a specific exploit technique doesn’t fix the underlying TOCTOU pattern.
3. The fix surface is large — The Cloud Files API has many code paths; patching one doesn’t guarantee others aren’t vulnerable.

This appears to be exactly what happened with CVE-2020-17103: Microsoft may have fixed a specific attack vector without addressing the fundamental TOCTOU condition in the placeholder creation path.

Impact Assessment

Who’s Affected?

Everyone running Windows. The cldflt.sys driver is present and loaded by default on:

• Windows 10 (all supported versions)
• Windows 11 (all versions including May 2026 Patch Tuesday)
• Windows Server 2019, 2022, 2025/2026

You don’t need OneDrive configured or syncing — the driver is loaded regardless.

Attack Requirements

• Local access — Standard user account (no admin needed)
• Interactive session — The exploit needs to win a race condition
• Reliability — Chaotic Eclipse reports it “works reliably” but notes success rate may vary

What Can an Attacker Do?

Full SYSTEM privileges. This means:

• Install persistent malware
• Access all user data
• Create admin accounts
• Disable security software
• Pivot to domain admin in AD environments

Attack Chain Potential

A standard attack chain would combine MiniPlasma with an initial access vector:

1. Phishing / initial access → Standard user code execution
2. MiniPlasma → SYSTEM privilege escalation
3. Persistence / lateral movement → Domain compromise

Detection & Mitigation

Detection

Look for these indicators:

# Process creation from unusual parent
- Parent: Unprivileges process → Child: cmd.exe with SYSTEM integrity
- Command line containing unusual CfCreatePlaceholders patterns

# Sysmon Event ID 1 (Process Creation)
- SYSTEM shell spawned from standard user context

# Driver-level
- cldflt.sys IRP handling anomalies
- Unexpected registry key creation in .DEFAULT hive

Mitigation (Until Microsoft Patches)

Since this is a race condition in a kernel driver, mitigations are limited:

1. Enable LSA Protection — Doesn’t prevent MiniPlasma directly but raises the bar for post-exploitation
2. Restrict interactive logon — Limit who can log on locally (the exploit requires an interactive session)
3. Application whitelisting — Prevent unknown executables from running
4. Monitor for exploit artifacts — Watch for SYSTEM shells from standard user processes
5. Consider disabling cldflt — Not recommended as it breaks OneDrive; only for air-gapped systems where cloud sync isn’t needed

The Real Fix

Microsoft needs to properly address the TOCTOU condition in HsmOsBlockPlaceholderAccess — not just the specific exploit technique, but the race condition pattern itself. The fact that a 2020 “fix” didn’t hold suggests the patch was superficial.

The Bigger Picture: What This Tells Us About Patching

MiniPlasma is a wake-up call for the entire industry:

1. “Patched” Doesn’t Mean “Fixed”

CVE-2020-17103 was marked as resolved. For over five years, everyone from enterprise security teams to vulnerability scanners treated it as closed. The reality? The vulnerability was live the entire time.

2. Regression Testing Is Critical

Either the patch was never effective, or it was silently reverted. Both scenarios point to gaps in Microsoft’s regression testing — a known vulnerability class (TOCTOU in the same driver) should have ongoing regression tests.

3. The Disclosure Dilemma

Chaotic Eclipse’s approach is controversial but effective. Microsoft’s bug bounty process clearly failed this researcher. When the cost of responsible disclosure exceeds the cost of public release, the system is broken.

4. Defense in Depth Is Non-Negotiable

No single patch should be your only defense. Assume vulnerabilities exist. Layer your controls: EDR, least privilege, network segmentation, monitoring.

References

• MiniPlasma GitHub Repository — PoC source code
• Original Google Project Zero Report — James Forshaw, September 2020
• CVE-2020-17103 — Microsoft Security Response Center
• BleepingComputer Coverage
• SecurityWeek Analysis
• The Hacker News Report
• Exodus Intelligence Technical Deep Dive — Related cldflt.sys TOCTOU analysis (CVE-2025-55680)
• Will Dormann’s Confirmation — Verified working on May 2026 Patch Tuesday

🦞 Patch your assumptions, not just your CVEs.