提交 #895271: Chengdu Qilu Technology Ludashi (鲁大师) 6.1026.4715.714 Missing Authentication

1. Vendor Information
Vendor Name: Chengdu Qilu Technology Co., Ltd. (成都奇鲁科技有限公司)
Vendor Website: https://www.ludashi.com/

2. Product Information
Product Name: Ludashi (鲁大师)
Affected Version: 6.1026.4715.714
Affected Component/File: ProtectFilter64.sys (Kernel Driver)
Exposed Interface: FltMgr Communication Port (\basics_protection{a2a6243497254169b5db2a7eb1b36df0})

3. Vulnerability Classification
Vulnerability Type: CWE-862 (Missing Authorization) / CWE-400 (Uncontrolled Resource Consumption)
Impact: Security Feature Mitigation Bypass (Anti-Tamper Bypass) / Local Denial of Service (System Hang)
Required Privilege Level: Local Administrator / Elevated Context (High Integrity Token)

4. Short Description for the CVE Entry
Chengdu Qilu Technology Co., Ltd. Ludashi version 6.1026.4715.714 allows local authenticated administrators to bypass Windows Protected Process Light (PPL) anti-tamper mitigations and cause a Local Denial of Service (DoS) via its kernel driver communication port. The driver processes commands to globally suspend all newly created processes within its creation callback without checking the target's protection flags or system criticality. An attacker can leverage this behavior to permanently freeze endpoint security tools like Windows Defender (MsMpEng.exe) during service recovery loops, or indefinitely deadlock all subsequent system processes, leading to a complete and unrecoverable system hang.

5. Analysis Details
The communication port message callback(.text:0000000140001600):
```c++
__int64 __fastcall MessageNotifyCallback(...)
{
// ....
command = *InputBuffer;
// ....
// ....
v24 = (unsigned int)(v23 - 1);
if ( (_DWORD)v24 )
{
// v24 is the command caculated to 0x17
if ( (_DWORD)v24 == 1 )
{
// .text:000000014000175E
// ControlProcess routine can suspend/resume/terminate a process according to the input parameters
// InputBuffer[1] indicate process Id and InputBuffer[2] indicate suspend or resume operation will be appiled to that process
v13 = ControlProcess(ProcessList.Flink, InputBuffer[1], InputBuffer[2] != 0);
goto LABEL_46;
}
else
{
// command = 0x16, reset the check counter
ResetCheckCount(v24);
status = 0;
}
goto LABEL_49;
}

// ....
// .text:0000000140001659
// v9 is command caculated to 0x0
if ( !(_DWORD)v9 )
{
// StartProcessMonitor will call PsSetCreateProcessNotifyEx to register a notify callback
// that callback will collect all the process creation and deletion information, and store the creation information into a global data structure(G)
// when the command(0x17, see ControlProcess) is sent to driver, it will first search to see if that process specified by user is exist in G and then
// execute suspend/resume/terminte if it is
v13 = ((__int64 (__fastcall *)(__int64))StartProcessMonitor)();
goto LABEL_46;
}
}
```

The process notify callback(.text:0000000140002550):
```c++
void __fastcall ProcessNotify(...)
{
// ....

// .text:0000000140002777
// SenderBuffer[148] is TRUE indicate this is a process creation event
if ( LODWORD(SenderBuffer[148]) )
{
if ( !SendNotifyInfoToClient(SenderBuffer, 0x8ACu, nullptr, nullptr, &v15)
&& !ProcessAlreadyExistInRepo((PROCESS_RECORD_REPO *)ProcessList.Head.Flink, (unsigned int)ProcessId) )
{
// All the subsequent created process will be unconditionally suspended after user send command 0x0(see subroutine StartProcessMonitor in MessageNotifyCallback)
SuspendResumeProcess_0((__int64)Process, 1);

// This will add process creation record into global storage, if the user later want to kill a process will firstly check if it exists in that storage
AddProcessRecord(ProcessList.Head.Flink, (__int32)ProcessId, (__int64)&SenderBuffer[4], SenderBuffer[3]);
}
}
else
{
v15.QuadPart = -1000;
SendNotifyInfoToClient(SenderBuffer, 0x8ACu, nullptr, nullptr, &v15);
}

// ....
}
```

6. Detailed Technical Analysis
Architecture Overview

The ProtectFilter64.sys kernel driver registers a Filter Manager communication port under the path \basics_protection{a2a6243497254169b5db2a7eb1b36df0} using the FltCreateCommunicationPort API. While the port utilizes a default security descriptor (FLT_PORT_ALL_ACCESS) that correctly restricts access to administrative users, the driver's inner message dispatch logic lacks authorization checks regarding the target objects it manipulates.
The Security Boundary Failure

The driver exposes a specific control command via its MessageNotifyCallback routine that allows the client application to enable a global process suppression rule. When activated, the driver hooks into process life-cycle operations using a process creation callback (PsSetCreateProcessNotifyRoutineEx).

When any new process spawns, the driver's callback intercepts it and forcibly places it into an indefinite suspended state before the user-mode main thread begins execution.

The security vulnerability lies in the fact that the driver does not validate whether the target process is protected by the operating system. Under normal conditions, the Windows kernel prevents local administrators from freezing or tampering with Protected Process Light (PPL) anti-malware processes (such as MsMpEng.exe). However, because this driver executes in Ring 0 (Kernel Mode), its global suspension mechanism completely overrides these native OS protections.
Exploit Scenario (Anti-Tamper Bypass)

An attacker operating in an administrative context can leverage this behavior to permanently neutralize endpoint detection capabilities using a standard Bring Your Own Vulnerable Driver (BYOVD) approach:

The attacker opens a handle to the communication port and sends the command to globally suspend all new processes.

The attacker terminates the active security agent process (MsMpEng.exe).

The Windows Service Control Manager automatically attempts to launch a new instance of the security agent to protect the system.

The driver's kernel callback intercepts the newly spawned PPL process at creation time, placing it into a permanent deadlocked state before it can initialize its protection mechanisms.

As a result, the operating system's self-healing security loop is permanently broken, allowing arbitrary unmonitored execution on the system.

7. Steps to Reproduce (PoC Walkthrough)
Load the affected ProtectFilter64.sys driver version 6.1026.4715.714

Execute a user-mode utility with elevated privileges to connect to the communication port \basics_protection{a2a6243497254169b5db2a7eb1b36df0}.

Transmit the crafted configuration payload to activate the driver's process creation suspension routine.

Terminate the active instance of Windows Defender (MsMpEng.exe) using standard system utilities(such as ProcessHacker).

Observe the operating system behavior: The service control manager creates the replacement process, but the process remains completely deadlocked and unresponsive in a suspended state indefinitely, successfully defeating the PPL protection boundary.

Furthermore after your have done all the above steps, the subsequent newly created process can not start normally, they will be in suspended state(forever) or even can not appear in process list

8. Proof Of Concept(POC)
Here is a full POC demonstrate how to reproduce the flaw
Secret Gist:
https://gist.github.com/lzty/fc5f336dca4c287ab4c22168b6dc8ec2

• 来源: ⚠️ https://gist.github.com/lzty/fc5f336dca4c287ab4c22168b6dc8ec2
• 用户: Bigcat (UID 99687)
• 提交: 2026-07-19 04時16分 (2 月前)
• 管理: 2026-09-12 10時52分 (2 months later)
• 状态: 已接受
• VulDB条目: 403096 [Chengdu Qilu Technology Ludashi 6.1026.4715.714 Message Dispatch ProtectFilter64.sys MessageNotifyCallback 权限提升]
• 积分: 20