Description

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-10-12T13:17:27.660Z",
  "pubdate": "2026-10-12T13:17:27.660Z",
  "executiveSummary": "A critical security vulnerability has been identified in the IOCTL Process Termination component of Yungengxin Cloud Billing version 2024.11.28.11.\nThe vulnerability resides within the LWBilling64.sys kernel-mode driver, specifically affecting the sub_14000443C function.\nThe flaw allows a local, unprivileged attacker to perform arbitrary process termination by exploiting an improperly secured IOCTL (Input/Output Control) interface.\nThe root cause is identified as insufficient access control, which fails to validate the context or permissions of the calling process when handling requests directed at the IOCTL handler.\nAn attacker can leverage this flaw to terminate system-critical processes, leading to potential denial-of-service conditions or the subversion of security software.\nPublicly available exploit code increases the risk level, as the barrier to entry for malicious actors is significantly lowered.\nThe vendor has been notified of the vulnerability but has remained unresponsive, leaving deployments exposed without official patches.",
  "technicalDetails": "The vulnerability manifests within the LWBilling64.sys kernel-mode driver, which exposes an IOCTL interface to user-mode applications for process management. Specifically, the function sub_14000443C acts as the primary handler for IOCTL requests associated with the process termination functionality.\nThe security failure stems from a lack of adequate access control checks (e.g., lack of proper SeDebugPrivilege validation or origin verification) within the IOCTL dispatch routine. When the driver receives an IOCTL request, the sub_14000443C function parses the provided input buffer to extract the target Process ID (Pid).\nBecause the function fails to enforce security boundaries, it blindly processes the user-supplied Pid value, allowing a local user to send a specially crafted IOCTL request to the device object created by LWBilling64.sys. The driver, operating with kernel-level privileges, proceeds to execute a termination routine on the PID specified in the buffer without verifying if the caller possesses the requisite authorization to terminate the target process.\nThe attack flow proceeds as follows: 1) The attacker opens a handle to the vulnerable device object exposed by LWBilling64.sys using the CreateFile function. 2) The attacker crafts an input buffer containing the target PID that they wish to terminate. 3) The attacker triggers the vulnerable IOCTL using the DeviceIoControl API, specifying the control code that routes to sub_14000443C. 4) The driver, upon receiving the request, interprets the malicious PID and calls the internal kernel API (such as ZwTerminateProcess or similar) to kill the target process.\nThe impact of this vulnerability is significant, as it grants a local user the ability to terminate arbitrary processes, including those running as SYSTEM or those belonging to security software, effectively bypassing standard OS access controls. Given the existence of published exploit scripts, the vulnerability is susceptible to active exploitation by local threats. The absence of vendor-supplied remediation necessitates immediate manual intervention to prevent exploitation in environments where the driver is active."
}