| tiêu đề | Hangzhou Shunwang Technology Co., Ltd. shzh 10.7.2.693 Incorrect Default Permissions |
|---|
| Mô tả | Vulnerability Timeline & Prior Proposal Notice:
- Initial Base Entry Logged: July 12, 2026
- Baseline Telemetry Syncing: July 14, 2026 (via Tracker ID CAN-2026-2033570)
The discoverer initially logged the technical details and telemetry of this vulnerability under tracker ID CAN-2026-2033570 on July 12, 2026. This VulDB submission represents the formal technical escalation and active CVE assignment request by the original, exclusive author (ElementXu) to transition this public intelligence into an active CVE entry.
Summary:
A critical local security boundary bypass and denial of service vulnerability was identified in Hangzhou Shunwang Technology Co., Ltd. shzh (version 10.7.2.693). The product's kernel driver "shdrv_x64.sys" (SHA256: e3b99f727e59aab08862a161df7e3d7790842a76c42184fb4ba267db14eae4fa) implements flawed default permissions on its exposed device object.
Technical Analysis & Exploit Primitives:
The kernel driver creates a named device object at "\\.\shdrv" with a NULL Discretionary Access Control List (DACL), leading to improper access control. This architectural flaw allows any unprivileged local user-mode process (Low/Medium Integrity) to successfully acquire a valid handle to the device.
The IRP_MJ_DEVICE_CONTROL dispatch routine (sub_180004AC0) completely fails to enforce access control or caller identity validation on incoming requests. An unprivileged local attacker can issue an IOCTL code 0x22E018 containing a controlled target Process Identifier (PID). This PID payload is directly passed into an internal routine (sub_180002A30) that chains ZwOpenProcess -> ZwTerminateProcess inside the Ring 0 kernel context without security verification.
Impact & Prior Art Distinction:
Because the termination sequence executes within the kernel context, an unprivileged attacker or standard local malware payload can abuse this legitimate, Shunwang-signed driver to arbitrarily terminate critical system components, standard unprotected anti-virus processes, or business-critical application processes. This completely subverts standard user-mode access control policies, leading to a permanent local Denial of Service (DoS) or the disruption of endpoint security monitoring infrastructures.
Importantly, this vulnerability is distinct from CVE-2023-44976. It affects a newer driver component "shdrv_x64.sys" (v10.7.2.693) utilizing the device link "\\.\shdrv" with a NULL DACL, whereas CVE-2023-44976 targeted the legacy "rentdrv2.sys" driver and its device "\\.\rentdrv2" using an entirely different IOCTL code (0x22E018 vs 0x22E010).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]).
References & Public Evidence:
- https://www.virustotal.com/gui/file/e3b99f727e59aab08862a161df7e3d7790842a76c42184fb4ba267db14eae4fa
|
|---|
| Nguồn | ⚠️ https://www.virustotal.com/gui/file/e3b99f727e59aab08862a161df7e3d7790842a76c42184fb4ba267db14eae4fa |
|---|
| Người dùng | Element2023H (UID 99757) |
|---|
| Đệ trình | 17/07/2026 09:44 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 20/09/2026 21:32 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 408054 [Hangzhou Shunwang Technology shzh 10.7.2.693 IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 PID Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|