| Título | yungengxin(Chengdu Lingzhifeng) Yun Jia Security Guard (云甲安全卫士 / Cloud Armour Security Guard) 2.7.1.9 Improper Privilege Management |
|---|
| Descrição | Title:
Yun Jia Security Guard (云甲安全卫士) kgameprotect.sys - Arbitrary Process Termination via Unauthenticated IOCTL 0x222048
Vendor:
Chengdu Lingzhifeng (成都领之锋科技有限公司)
Website: https://yungengxin.com/
Product:
Yun Jia Security Guard (云甲安全卫士 / Cloud Armour Security Guard)
Component: kgameprotect.sys
Affected Version:
x.x.x.x (possibly earlier versions as well)
File Information:
- Filename: kgameprotect.sys
- Path in installer: lwcloudarmour_x64_2.7.1.9_Setup\client\driver\kgameprotect.sys
- SHA256: 6c1d596d18213e24f0c88d58ea7f3ca24114eded806b6198a8abc701251126ee
- Download URL: https://file.yjaqws.com/download/upgrade/lwcloudarmour/lwcloudarmour_Setup.zip
- Digital Signature: Microsoft Windows Hardware Compatibility Publisher
- Signature Timestamp: 2026-08-05 16:48:23 (Valid Microsoft WHQL signature)
Vulnerability Type:
- CWE-862: Missing Authorization
- CWE-269: Improper Privilege Management
- Arbitrary Process Termination / Local Privilege Escalation / Security Feature Bypass
Description:
The kernel-mode driver kgameprotect.sys creates a device object \Device\kgameprotect and exposes an unauthenticated IOCTL code 0x222048.
Any user-mode process capable of opening a handle to this device can send the IOCTL with a process ID (PID) in the input buffer. The driver then performs the following actions without any authentication, authorization, or caller validation:
1. PsLookupProcessByProcessId()
2. ObOpenObjectByPointer()
3. ZwTerminateProcess()
This allows a low-privileged local user to terminate arbitrary processes, including antivirus, EDR, and other security-related or system processes.
Technical Details:
Device Object: \Device\kgameprotect
Vulnerable IOCTL: 0x222048
Relevant IDA decompiled code:
NTSTATUS __fastcall sub_140002680(PDEVICE_OBJECT DeviceObject, IRP *Irp)
{
...
case 0x222048u:
if (CurrentStackLocation->Parameters.Create.Options >= 4)
{
SystemBuffer = (unsigned int *)Irp->AssociatedIrp.SystemBuffer;
if (SystemBuffer)
{
Pid = *SystemBuffer;
if ((int)sub_14000885C(Pid) >= 0) // Terminate process
{
// logging code...
}
}
}
...
}
Process termination function:
__int64 __fastcall sub_14000885C(void *Pid)
{
NTSTATUS v2;
PEPROCESS Process = NULL;
HANDLE ProcessHandle = NULL;
v2 = PsLookupProcessByProcessId(Pid, &Process);
if (v2 >= 0)
{
v2 = ObOpenObjectByPointer(Process, 0x200, NULL, 1, PsProcessType, KernelMode, &ProcessHandle);
if (v2 >= 0)
{
v2 = ZwTerminateProcess(ProcessHandle, STATUS_ACCESS_DENIED);
ZwClose(ProcessHandle);
}
ObfDereferenceObject(Process);
}
return v2;
}
No privilege checks or caller validation are performed.
Impact:
- Local low-privileged attackers can terminate arbitrary processes.
- Can be abused to disable security products (AV/EDR).
- Useful in BYOVD (Bring Your Own Vulnerable Driver) attack scenarios.
- The driver carries a valid and very recent Microsoft signature (2026-08-05), allowing it to load on modern Windows systems with Driver Signature Enforcement enabled.
Proof of Concept:
1. Load the driver (via the official software installation).
2. Open a handle to \\.\kgameprotect (or the corresponding symbolic link) from a normal user account.
3. Call DeviceIoControl with:
- dwIoControlCode = 0x222048
- Input buffer containing a 4-byte Process ID
4. The target process is terminated.
Timeline:
- 2026-09-11: Vulnerability discovered and reported to VulDB
- Vendor notification: Pending (coordinated disclosure will be attempted)
Credits:
Element Xu(@Element2023H)
References:
- Official website: https://yungengxin.com/
- Driver download: https://file.yjaqws.com/download/upgrade/lwcloudarmour/lwcloudarmour_Setup.zip |
|---|
| Utilizador | Element2023H (UID 99757) |
|---|
| Submissão | 11/09/2026 06h03 (há 1 mês) |
|---|
| Moderação | 11/10/2026 13h43 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416609 [Yungengxin Yun Jia Security Guard até 2.7.1.9 kgameprotect.sys sub_14000885C Pid Elevação de Privilégios] |
|---|
| Pontos | 17 |
|---|