Description

A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.4",
  "pubDate": "2026-09-13T10:16:55.900Z",
  "pubdate": "2026-09-13T10:16:55.900Z",
  "executiveSummary": "A missing authorization vulnerability has been identified within the Message Dispatch Handler component of Chengdu Qilu Technology Ludashi version 6.1026.4715.714.\nThe flaw resides specifically within the MessageNotifyCallback function located in the ProtectFilter64.sys kernel-mode driver.\nThis vulnerability allows a local attacker to perform unauthorized operations, potentially bypassing security controls intended to restrict communication or actions handled by the driver.\nThe risk is elevated due to the public availability of an exploit, increasing the likelihood of malicious utilization.\nDespite proactive attempts to disclose this vulnerability to the vendor, there has been no official response or remediation effort.\nSuccessful exploitation requires local access to the target system, granting the attacker the ability to interact with the vulnerable kernel driver directly.",
  "technicalDetails": "The vulnerability is a missing authorization flaw located in the MessageNotifyCallback function of the ProtectFilter64.sys driver, a component of the Ludashi Message Dispatch Handler.\nKernel-mode drivers, such as ProtectFilter64.sys, are responsible for managing sensitive system operations. The MessageNotifyCallback function serves as an entry point for processing internal or external message notifications.\nThe root cause of this vulnerability is the failure of the function to perform adequate validation or authorization checks on the requests it receives. When a request is dispatched to this callback, the function does not verify if the calling process possesses the appropriate privileges or authorization to initiate the specific action requested.\nExploitation is conducted locally, as the driver is exposed to user-mode processes. An attacker can craft a malicious IOCTL (Input/Output Control) request or trigger the callback through exposed interfaces to interact with the vulnerable function.\nBecause the function fails to authenticate the requestor, the driver blindly executes the logic contained within the callback. This lack of access control allows a local, potentially low-privileged user to influence driver behavior or gain access to restricted kernel functions that should be guarded by standard Windows security descriptors.\nThe attack flow involves the attacker locating the device object associated with ProtectFilter64.sys. Once the communication channel is established, the attacker sends specially crafted data packets designed to trigger the MessageNotifyCallback logic.\nSince the callback lacks proper security gating, the driver performs the requested operations on behalf of the user, bypassing the intended security boundaries. In a post-exploitation scenario, this could lead to privilege escalation, arbitrary kernel-mode memory manipulation, or the disruption of system stability depending on the specific functionality exposed through the callback.\nThe public availability of an exploit significantly lowers the barrier to entry, enabling attackers to leverage existing code to achieve unauthorized execution within the kernel context. Given the lack of a vendor patch, the system remains in a vulnerable state where the driver does not enforce the principle of least privilege, allowing for potential system-wide compromise."
}