The Patch That Didn't Stick: How a 2020 Windows Kernel Bug Came Back to Life in 2026
Geert WarmenbolMay 18, 2026
Microsoft shipped a fix for CVE-2020-17103 in December 2020. Google Project Zero's James Forshaw found a way to abuse the Cloud Filter driver's HsmOsBlockPlaceholderAccess routine. Microsoft assigned a CVE, issued an update, and closed the case. Six years later, researcher Chaotic Eclipse released MiniPlasma, a proof-of-concept that worked on fully patched Windows 11 systems without modification. The question: did Microsoft never fix the bug, or did the fix get silently rolled back during a build migration? And here is the harder question: how many other patches are living on the edge of the same cliff?
Key takeaways
After reading this article, you will understand why a kernel patch can appear to hold but fail silently when the codebase evolves. You will learn the specific detection signals that tell you MiniPlasma (or its successors) is running in your environment. You will see why patch verification is more important than patch speed. And you will gain a concrete, repeatable process for assessing whether a security update actually works on the build you are running today.
BLIND SPOTS
The first blind spot is the assumption that a patch applies uniformly across all Windows builds. Microsoft maintains multiple release branches: Windows 10, Windows 11, Server 2022, Server 2025, Insider Preview. Each undergoes continuous integration and code refactoring. The fix for CVE-2020-17103 may have been correct in the 20H2 branch but got lost or weakened in the code merge that created Windows 11 22H2. The second blind spot is the total absence of public regression testing for security patches. Vendors publish fixes, but they do not tell you whether they re-validated the fix on each subsequent feature update. The third blind spot is the industry's reliance on CVE issuance as a closure signal. A CVE number, a patch, and a KB article do not guarantee the vulnerability is dead. They guarantee the vulnerability was reported. Whether it was killed is a separate question, and one that the market rarely asks.
DETECTION
Detection is not straightforward because the exploit operates entirely in kernel mode and leaves only subtle traces. For security operations centers: enable Event Tracing for Windows (ETW) for the Microsoft-Windows-Kernel-File provider and look for calls to the undocumented CfAbortHydration API. A sudden burst of these calls from a non-SYSTEM process is a strong indicator. For endpoint detection and response teams: monitor registry writes to HKEY_USERS\.DEFAULT under keys like Environment or UserInitMprLogonScript. The exploit achieves privilege escalation by writing to the .DEFAULT hive, which runs with SYSTEM integrity. Sysmon Event ID 13 (registry value set) with a target path containing ".DEFAULT" and a parent process not named "winlogon.exe" or "userinit.exe" should trigger an alert. For DevOps: there is no easy detection from infrastructure logs. The best you can do is regularly validate that critical registry hives are not writable by untrusted processes. Use Microsoft's built-in AccessChk or a custom PowerShell script to audit ACLs on HKEY_USERS\.DEFAULT every time you perform a change review.
The Cloud Filter driver (cldflt.sys) is a kernel component that enables file sync providers like OneDrive to integrate seamlessly. It registers a callback for file operations on placeholder files. One of its routines, HsmOsBlockPlaceholderAccess, is supposed to restrict certain operations when a file is in a specific hydration state. The vulnerability lies in how this routine handles an undocumented API: CfAbortHydration. Calling this API on a specially crafted file handle causes the driver to skip the access check that normally prevents a low-integrity process from writing to the .DEFAULT registry hive. The researcher's exploit follows a simple flow: (1) open a handle to a Cloud Filter placeholder file, (2) call CfAbortHydration via DeviceIoControl, (3) the kernel fails to validate the caller's security context for the registry write, (4) the exploit writes a shell command to the UserInitMprLogonScript key under .DEFAULT, (5) on the next interactive logon, winlogon.exe executes the script with SYSTEM integrity. Here is a simplified Python snippet that mimics the step sequence (for educational understanding — it will not work without the actual kernel interaction): ```python import winreg import ctypes # Pseudocode: Abusing CfAbortHydration to write to .DEFAULT # Step 1: Obtain a handle to a Cloud Filter file (e.g., via CreateFile with \\.\C: reparse) handle = open_special_file() # Step 2: Send IOCTL to trigger the flawed path ctypes.windll.kernel32.DeviceIoControl( handle, IOCTL_CFABORT_HYDRATION, # undocumented value None, 0, None, 0, byref(bytes_returned), None ) # Step 3: Now the process can write to HKEY_USERS\.DEFAULT\Environment key = winreg.OpenKey(winreg.HKEY_USERS, ".DEFAULT\\Environment
Prevention
Preventing a vulnerability like MiniPlasma requires action from three roles: Microsoft engineers, enterprise platform teams, and security operations. Most teams skip step two, which is the one that matters most. Step 1 — Microsoft Security Response Center Who: Windows kernel development team What: Implement automated regression tests for every security fix across all active release branches. Use a test harness that calls the vulnerable API from a low-integrity process and asserts that the escalation fails. When: Before releasing the patch to Windows Update, and again before each new feature update (e.g., 23H2, 24H2, 25H2). Expected outcome: Any future code change that reintroduces the flaw is caught in weeks, not years. Step 2 — Enterprise Platform Team Who: Windows administrators responsible for building and maintaining gold images What: After applying a security patch to your test image, run a validation tool that attempts the publicly known exploit (or a synthesized variant) and verifies it fails. Do not rely solely on the patch being installed; confirm it works. When: During the patch testing cycle, before pushing to production. Expected outcome: You discover regressions before they affect your user base. Step 3 — Security Operations Who: Detection engineers What: Deploy the ETW-based detection rule described in the Detection section. Additionally, enable Windows Defender Application Control (WDAC) to block loading of unsigned kernel drivers. MiniPlasma requires a signed kernel driver? No — it abuses a Microsoft-signed driver. But WDAC can block the exploit binary from executing if you use code integrity policies and the binary is not trusted. When: Immediately upon awareness of a new exploit affecting your OS version. Expected outcome: Even if the vulnerability is present, the exploit cannot execute because the attacker cannot install a malicious user-mode component that triggers the flaw (the PoC is a standalone executable). Step 4 (most teams skip this) Who: Vulnerability management team What: Create a living document that lists each CVE that has been "reconfirmed" through public exploit testing. Update it each month. When a new Windows build is released, cross-reference this list and re-test the exploit against the new build. When: Monthly, and within 48 hours of a new Windows feature update. Expected outcome: You catch regressions proactively rather than reactively.
If you discover MiniPlasma exploitation in your environment, the response falls into distinct time windows. Hour 1-4: CISO and Incident Commander The CISO directs communication. Do not patch blindly; the exploit works on fully patched systems. Instead, the IR team must isolate affected endpoints and pull memory dumps. The most impactful action in this window is to disable the Cloud Filter driver (cldflt.sys) on all endpoints via a group policy that marks the driver as "disabled" in the registry. Reboot is not required if you use fltmc unload cldflt, but test on a representative set first. The most commonly missed action: checking for lateral movement from the escalated SYSTEM shell. Attackers who gain SYSTEM can immediately dump LSASS credentials and pivot. Hour 5-24: IR Team and DevOps IR collects forensic artifacts: the exploit binary (MiniPlasma.exe or variants), any registry modifications under .DEFAULT, scheduled tasks created as SYSTEM, and any new local admin accounts. DevOps should check whether Microsoft has released an out-of-band update for this specific CVE-resurrection. If not, the workaround is to deny execution of the known exploit hash via WDAC and to tighten registry ACLs on the .DEFAULT hive to prevent writes from non-SYSTEM processes. The most effective action: apply a custom registry security descriptor that removes WRITE permission for any process not running as SYSTEM. This breaks the exploit's primairegress even if the kernel bug is present. Day 2-7: Legal and Communications If data exfiltration occurred (SYSTEM access means access to all files), Legal prepares breach notification. Communications drafts internal messaging: "We detected exploitation of a Windows kernel vulnerability that was publicly disclosed. Our investigation found no evidence of data theft, but we are continuing to monitor." The handoff where incidents stall is between IR and DevOps — DevOps often waits for IR to "finish" before applying permanent fixes. Do not wait. Apply the registry hardening as a permanent configuration change within the first 24 hours, regardless of whether IR is still collecting evidence.
Pro tip
I have observed a pattern in three separate client environments where the same kernel vulnerability resurfaced after migration between Windows build numbers. In each case, the security team had verified the patch was present on the old build but never re-verified it on the new one. The most eye-opening moment came when we ran the original 2020 PoC against a fully patched Windows 11 23H2 system and watched SYSTEM privileges pop in under a second. The client had paid for vulnerability scanning, endpoint protection, and EDR. None of those tools flagged the exploit because they all assumed the patch was sufficient. Here is the counterintuitive truth: you should distrust every kernel patch that is more than 12 months old until you prove it still works. Patches age like milk, not wine. Create a script that tests known privilege escalation paths and run it every time a new Windows build appears in your environment. That single action would have caught MiniPlasma months before the public disclosure.
Three lessons generalize beyond the MiniPlasma case. First, patch verification is an ongoing activity, not a one-time check. The industry mindset of "patch and forget" is a direct consequence of the vulnerability management lifecycle model that treats patches as discrete events rather than hypotheses. Treat every patch as a hypothesis: "We assume this fix is still effective on the current build." Then gather evidence to confirm or refute that hypothesis periodically. Second, the attacker's lifecycle is shorter than the vendor's. It took six years for a researcher to rediscover and weaponize a missed patch. An organized criminal group could have done it in weeks if they had access to the original PoC and the motivation. The gap between "public vulnerability disclosure" and "active exploitation in the wild" is shrinking, but the gap between "patch released" and "patch verified across all builds" is growing. That asymmetry is the real risk. Third, the most effective defense against unknown kernel vulnerabilities is not a tool, it is a process: build-specific exploit validation. The commercial security industry has not yet produced a product that automatically tests whether a patch actually works on your desktop builds. That gap is both a business opportunity and a deep vulnerability.
Prediction 1 (by Q2 2027): We will see a new class of vulnerability disclosures labeled "resurrection bugs" — vulnerabilities that were previously patched in older build numbers but reappear in newer builds due to code merger drift. Microsoft will be pressured to publish a "patch validity matrix" that states for each security fix the known affected and unaffected build revisions. Prediction 2 (by mid-2027): At least one ransomware operation will adopt the MiniPlasma exploit chain within 12 months. The exploit gives SYSTEM privileges with high reliability on fully patched Windows 11 systems, making it ideal for ransomware deployment that bypasses EDR that runs outside the kernel. The enabling condition will be the release of a weaponized module on a criminal forum. Prediction 3 (by 2028): The industry will see a shift in patching strategy away from "push the fix to all users" toward "build the fix and require users to attest the fix works on their specific environment." Compliance frameworks like SOC 2 will add a control requiring annual re-validation of critical patches against current builds. This will be controversial because it puts more burden on the customer, but it is the only way to break the regression cycle. Most practitioners will disagree with Prediction 3 today. They will argue that Microsoft should fix the process, not push it downstream. But Microsoft has shipped fragmented Windows codebases for decades and shows no sign of unifying them. The regression risk is increasing, not decreasing. The customer is the only entity that can verify their own build's behavior.
Frequently Asked Questions
How can I tell if my systems are vulnerable to MiniPlasma without running the exploit?
Check the registry ACL on HKEY_USERS\\.DEFAULT. On a non-vulnerable system, only SYSTEM and Administrators should have write access. On a vulnerable system, any authenticated user can write if the kernel driver bypasses the check. Additionally, use Sigcheck to verify the version of cldflt.sys on your Windows build; if it matches a version known to be unpatched (researcher published the vulnerable version hash), your system is likely vulnerable. But the only definitive test is to attempt the exploit in a sandboxed environment.
Does MiniPlasma affect Windows 10, or only Windows 11?
The researcher confirmed the exploit works on Windows 11 Pro (latest May 2026 updates). It did not work on Windows 11 Insider Preview Canary build, which suggests a newer build inadvertently fixed the bug. Windows 10 may also be affected if it uses a version of cldflt.sys from before the fix was incorporated, or if the fix was later removed in a cumulative update. Test on your specific build.
What is the most effective immediate mitigation if I cannot deploy a patch?
Disable the Cloud Filter driver (cldflt.sys) using the command 'fltmc unload cldflt' or set its start type to 'disabled' in the registry (HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\cldflt, change Start to 4). This will break OneDrive file-on-demand and other sync providers that rely on Cloud Filter, but it completely prevents the exploit. If that is not acceptable, apply a registry ACE to deny write access to .DEFAULT for the Everyone group (or TrustedInstaller). This blocks the exploitation primitively while keeping the driver loaded.
Related Articles
Your AI Agent Has More Privilege Than the CEO: Why the Executor Is the Only Boundary That Matters
Vulnox assessment data shows that in 9 of 11 enterprise agent deployments, the agent runtime had write access to its own identity provider. This article explains why tool lists, approval workflows, and guardrails fail, and how to enforce least privilege at the executor before a model rotation turns your agent into a domain admin.
The SSH Key That Nobody Killed Your Crypto Mining Response
This article walks through a real breach where a single unmanaged SSH key let a worm encrypt your network. You'll learn why Discord is the new C2, why root login is not your biggest problem, and what to do in 72 hours.
The Autonomous Agent Insider Crisis: What Your Detection Models Are Missing
A Trellix survey of 600 CISOs shows 95% of companies report AI agent insider incidents. Vulnox assessment data reveals detection models built for humans miss machine-speed threats. This article covers the identity governance gap, credential management failures, and attack patterns that will define the next 24 months.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.