Ludashi
Monthly
Information disclosure in Chengdu Qilu Technology Ludashi 6.1026.4715.714 allows a local high-privileged attacker to read arbitrary physical memory by sending a crafted IOCTL with a manipulated PhysicalAddress argument to the kernel driver ComputerZ_x64.sys. The vulnerable function sub_11008 exposes physical memory read capability to user-mode callers without adequate address validation, a classic pattern in poorly designed Windows kernel drivers that can expose sensitive in-memory data such as credentials or cryptographic material. A public exploit has been published; no vendor patch exists as the vendor did not respond to coordinated disclosure.
Information disclosure in Chengdu Qilu Technology Ludashi 6.1026.4715.714 allows a local high-privileged attacker to read arbitrary physical memory by sending a crafted IOCTL with a manipulated PhysicalAddress argument to the kernel driver ComputerZ_x64.sys. The vulnerable function sub_11008 exposes physical memory read capability to user-mode callers without adequate address validation, a classic pattern in poorly designed Windows kernel drivers that can expose sensitive in-memory data such as credentials or cryptographic material. A public exploit has been published; no vendor patch exists as the vendor did not respond to coordinated disclosure.