Description

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal in the distributed binary and computing valid MD5 authentication tags for arbitrary IOCTL write requests. Attackers can additionally bypass a secondary validation gate by using the driver's own bit-clear IOCTL to clear a single bit in the gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T19:17:28.140Z",
  "pubdate": "2026-09-04T19:17:28.140Z",
  "executiveSummary": "The vulnerability involves an improper implementation of authentication mechanisms within the DirectIo64.sys driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. This flaw stems from the use of hard-coded credentials, specifically an 8-byte key embedded within the driver binary. This security oversight allows local attackers to compute valid MD5 authentication tags, effectively bypassing the driver's security controls for arbitrary physical memory write operations.\nThe impact is severe, as successful exploitation permits a local attacker to perform arbitrary write operations to physical memory, which can lead to full system compromise, escalation of privileges, and the subversion of kernel-level integrity. The vulnerability affects PassMark PerformanceTest versions prior to 11.1 build 1012, BurnInTest versions prior to 11.1 build 1000, and OSForensics versions prior to 11.1 build 1016. Because the flaw resides in the driver's IOCTL interface, local privilege is required to initiate the attack; however, once executed, the attacker can bypass additional validation gates, including MAC verification, size constraints, and Vendor ID checks, to gain unrestricted write access to the platform memory.",
  "technicalDetails": "The root cause of this vulnerability is the presence of a hard-coded 8-byte key within the DirectIo64.sys driver binary, which is used to generate MD5-based authentication tags for IOCTL requests. Because this key is static and embedded directly in the distribution, any local attacker can reverse-engineer the binary to extract the key and craft legitimate-looking authentication tags for arbitrary memory write requests.\nThe attack flow begins with the local attacker gaining access to the system, where they can interface with the DirectIo64.sys device driver. By extracting the 8-byte literal from the binary, the attacker can compute a valid MD5 checksum for any payload. When an IOCTL write request is issued, the driver verifies this tag against the embedded key. If the calculated tag matches the provided request, the driver proceeds with the write operation, granting the attacker the ability to modify arbitrary physical memory addresses.\nFurthermore, the vulnerability includes a logic flaw in a secondary validation gate. The driver exposes a specific bit-clear IOCTL that allows an attacker to manipulate the binary code of the driver in memory. By targeting the displacement byte of a gating instruction, the attacker can flip a bit to neutralize the security logic entirely. This results in the driver skipping all subsequent security checks, including Message Authentication Code (MAC) verification, request size validation, and Vendor ID enforcement. This bypass essentially renders the driver's interface a permanent, unauthenticated primitive for physical memory access.\nExploitation requires the attacker to have the ability to send IOCTL requests to the driver, typically necessitating local user privileges. Once the driver is loaded, the attacker can leverage the hard-coded key to bypass initial authentication or the bit-clear IOCTL to disable security checks permanently. Post-exploitation, an attacker can modify kernel structures, disable PatchGuard, or inject malicious code into critical system processes, leading to total control over the host operating system."
}