Description

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-04T19:17:27.997Z",
  "pubdate": "2026-09-04T19:17:27.997Z",
  "executiveSummary": "A high-severity privilege escalation vulnerability exists in the DirectIo64.sys driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. The vulnerability stems from an insecure implementation of an IOCTL handler that lacks necessary input validation for physical memory addresses.\nBy interacting with the exposed device handle, a local authenticated attacker can issue specially crafted IOCTL requests to clear arbitrary bits at any physical memory address. This capability facilitates unauthorized modifications to kernel-mode memory, including critical kernel code pages and page table entries (PTEs).\nSuccessful exploitation allows a local user to bypass kernel security protections, potentially leading to arbitrary code execution with SYSTEM privileges or full system compromise. The vulnerability requires local access to the target machine to open the device handle, but does not require prior administrative privileges, making it a critical escalation vector for malicious actors who have already gained low-privileged access to the system.",
  "technicalDetails": "The vulnerability resides within the DirectIo64.sys kernel-mode driver, which acts as a bridge for hardware-level operations. The driver exposes a device interface that allows user-mode applications to communicate via IOCTLs. The specific flaw occurs in the handler responsible for bitwise operations on physical memory. The driver fails to perform adequate bounds checking or validation on the physical address parameter supplied by the user-mode caller.\nWhen an attacker obtains a handle to the driver, they can invoke the vulnerable IOCTL handler by passing an arbitrary 64-bit physical memory address along with a bit index. Internally, the driver utilizes MmMapIoSpace to map the requested physical memory into the kernel's virtual address space. Because the driver performs no verification of the target address, it effectively grants the caller the ability to perform an atomic bit-clear operation on any location in system memory.\nExploitation follows a specific attack flow: First, the attacker acquires a handle to the DirectIo64.sys device. Second, the attacker calculates the physical address of sensitive structures, such as kernel page table entries or function pointers within the kernel code space. Third, the attacker issues the malicious IOCTL request to clear bits within these structures. By carefully targeting PTEs, an attacker can modify the permissions of virtual memory pages—for instance, turning a non-executable page into an executable one—or subvert kernel-mode control flow integrity (CFI) mechanisms. Finally, by redirecting execution flow to attacker-supplied shellcode, the process can escalate its privileges to SYSTEM.\nThis vulnerability is particularly dangerous because it bypasses standard hardware-backed security features by operating directly on the physical memory layout. The affected products include PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. The flaw is limited to local exploitation, but the impact is absolute, as it allows for persistent kernel-level compromise and the potential disabling of security auditing or endpoint protection software running at the kernel level."
}