Technical impact
The Ludashi driver exposed before version 5.1025 contains an access‑control flaw in its IOCTL handler. The driver accepts structures from any local user and maps the supplied lower 4 GB of physical addresses into kernel space with MmMapIoSpace. It then copies the contents back to user mode without checking the caller’s privileges or the validity of the address range. This allows an unprivileged user to read arbitrary physical memory, potentially leaking kernel data structures, pointers, security tokens, and other sensitive information. The disclosed information can be used to defeat KASLR and elevate to higher privileges locally.
Affected Systems
The vulnerability affects systems that install the Ludashi driver version 5.1024 or earlier. The driver registers a device interface that is globally accessible to normal users. Any installation using these older driver versions is susceptible; newer releases from 5.1025 onward contain the fix and therefore are not affected.
Risk and Exploitability
Security analysts have rated the flaw with a CVSS score of 7.3, indicating significant impact. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the flaw is not currently listed in CISA’s KEV catalog. However, since the flaw is exploitable by a local user, an attacker can leverage it to read kernel memory and potentially gain privileged kernel access. The attack requires only low technical skill to invoke the vulnerable IOCTL and does not rely on network exposure.
