Description

A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub_180004AC0 of the file shdrv_x64.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation of the argument PID leads to denial of service. The attack must be carried out locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-21T04:17:36.393Z",
  "pubdate": "2026-09-21T04:17:36.393Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the Hangzhou Shunwang Technology shzh driver component, specifically within the IRP_MJ_DEVICE_CONTROL handler of the shdrv_x64.sys file.\nThe vulnerability is triggered by improper input validation of the PID (Process Identifier) argument provided to the driver via IOCTL requests.\nSuccessful exploitation results in an immediate system crash (Blue Screen of Death), causing a complete loss of system availability.\nThe vulnerability is classified as a local attack vector, requiring the adversary to possess local access to the target system to execute the malicious IOCTL request.\nThere are no requirements for network access or specific user privileges beyond the ability to interact with the device object exposed by the driver, though kernel-mode interactions typically necessitate sufficient permissions.\nThe risk implication is significant for affected systems, as the instability introduced by the driver allows local unprivileged or low-privileged users to disrupt critical infrastructure operations without advanced exploitation techniques.",
  "technicalDetails": "The vulnerability resides within the function sub_180004AC0 of the shdrv_x64.sys kernel-mode driver, which serves as part of the IRP_MJ_DEVICE_CONTROL dispatch routine.\nThe core issue stems from insufficient bounds checking and improper validation of the PID argument passed from user-mode to kernel-mode during an I/O Control (IOCTL) operation.\nWhen the driver receives a specially crafted request containing a malicious or unexpected PID value, the sub_180004AC0 function fails to safely process the input before performing operations that directly affect kernel memory or process management structures.\nIn the attack flow, a local attacker maps the device object exposed by the driver and initiates a WriteFile or DeviceIoControl call containing the malformed PID data.\nUpon receiving the request, the driver passes the attacker-controlled data into sub_180004AC0, where the input is treated as a trusted integer without sanitization.\nIf the PID value references an invalid memory address or triggers an arithmetic error during the internal handling process, the kernel enters an inconsistent state, leading to a system-wide bugcheck.\nBecause the vulnerability occurs within kernel space, the resulting instability is unrecoverable, causing an immediate system crash and total denial of service for the host machine.\nThe driver fails to implement adequate error handling for the user-supplied buffer, essentially allowing for a forced kernel panic via memory corruption or dereferencing invalid process structures.\nAffected version is identified as shzh 10.7.2.693, and the risk remains persistent as long as the vulnerable driver remains loaded and the device interface is accessible to local user-mode applications.\nPost-exploitation impact is limited to system availability; however, the ease of triggering this DoS makes it a target for local resource exhaustion or forced system restarts."
}