Local Information Disclosure in Ludashi Driver Affecting Users' Privileges

CVE-2025-67246

What is CVE-2025-67246?

A local information disclosure vulnerability exists in the Ludashi driver prior to version 5.1025 due to insufficient access controls in the IOCTL handler. This weakness allows normal users to gain unauthorized access to a device interface that exposes lower 4GB of physical memory, enabling the mapping of arbitrary physical memory with MmMapIoSpace and the transfer of sensitive data back to user mode without adequate privilege verification. As a result, this can potentially reveal kernel data structures, security tokens, and kernel pointers. Furthermore, this vulnerability may facilitate additional exploitation techniques, such as bypassing Kernel Address Space Layout Randomization (KASLR), leading to local privilege escalation.

References