Description

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.3",
  "pubDate": "2026-09-13T09:16:31.933Z",
  "pubdate": "2026-09-13T09:16:31.933Z",
  "executiveSummary": "A local information disclosure vulnerability exists within the Chengdu Qilu Technology Ludashi software, specifically targeting the ComputerZ_x64.sys kernel-mode driver.\nThe vulnerability resides in the sub_11008 function, which fails to adequately sanitize the PhysicalAddress argument.\nThis flaw allows a local, authenticated attacker to gain unauthorized access to sensitive memory locations, leading to the disclosure of protected system information.\nThe vulnerability is currently subject to a publicly available exploit, increasing the risk of exploitation by malicious actors.\nDespite early notification, the vendor has failed to provide a response or remediation, leaving the affected version 6.1026.4715.714 exposed.\nSuccessful exploitation requires local access, but does not require remote network connectivity, making it a targeted risk for physical or locally authenticated compromise.",
  "technicalDetails": "The vulnerability is located in the driver component ComputerZ_x64.sys, which operates within the Windows kernel address space. The specific routine, sub_11008, acts as a handler for IOCTL requests initiated from user-mode applications.\nThe root cause of the flaw is an insufficient validation of user-supplied input provided via the PhysicalAddress argument. When a user-mode application interacts with the driver, the sub_11008 function performs operations on memory based on this parameter without verifying whether the requested physical address resides within the legitimate memory bounds allocated for the driver's operation.\nAn attacker can exploit this by crafting an input buffer that supplies a specifically calculated PhysicalAddress. Because the driver performs reads or writes based on this unsanitized pointer, an attacker can coerce the kernel-mode driver to disclose contents of kernel memory or other restricted physical addresses back to the user-mode process.\nThe attack flow follows a structured pattern: 1) The attacker initiates communication with the ComputerZ_x64.sys device object using standard Win32 APIs (e.g., CreateFile and DeviceIoControl). 2) The attacker passes an IOCTL code that triggers the vulnerable sub_11008 function. 3) The attacker injects the malicious PhysicalAddress payload into the input structure. 4) The driver processes the request at an elevated privilege level (Kernel Mode/Ring 0), bypassing standard user-mode memory protections. 5) The sensitive data read from the specified physical memory address is returned to the attacker's process space through the output buffer of the IOCTL call.\nGiven that the driver operates with system-level privileges, the ability to read arbitrary physical memory enables the circumvention of Kernel Address Space Layout Randomization (KASLR) and may lead to the exposure of cryptographic keys, kernel pointers, or sensitive system structures, facilitating further privilege escalation or system compromise.\nThe vulnerability is inherently local; it cannot be triggered remotely over a network. However, since the exploit is publicly available, any malicious local code execution—such as that delivered via malware or a malicious insider—can leverage this vulnerability to gain deeper insights into the host operating system state."
}