This vulnerability exists due to insufficient access control in the IOCTL handler of the Ludashi driver before version 5.1025. The driver exposes a device interface accessible to normal users and processes attacker-controlled structures referencing the lower 4GB of physical addresses. It uses MmMapIoSpace to map arbitrary physical memory and copies data back to user mode without verifying caller privileges or address ranges. This flaw allows local attackers to read arbitrary physical memory, potentially leaking kernel data structures, pointers, and security tokens. The information disclosure can be leveraged to bypass KASLR, increasing the risk of local privilege escalation.

An unprivileged local user can read arbitrary physical memory, exposing sensitive kernel information including security tokens and kernel pointers. This compromises confidentiality and can facilitate bypassing KASLR protections. While direct privilege escalation is not guaranteed, the vulnerability significantly aids attackers in escalating privileges locally. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to the affected driver and monitor for suspicious local activity. Avoid running untrusted code with local user privileges on affected systems.