Description

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T19:17:28.857Z",
  "pubdate": "2026-09-04T19:17:28.857Z",
  "executiveSummary": "An information disclosure vulnerability exists in the DirectIo64.sys driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. The vulnerability originates from an insecurely implemented IOCTL interface that allows unauthenticated local attackers to dump the complete contents of physical memory to an arbitrary file path.\nBecause the driver operates with SYSTEM privileges, the resulting memory dump is generated in the SYSTEM context, effectively bypassing user-mode Access Control Lists (ACLs) and standard file system protections. By extracting a full RAM image, an attacker can harvest highly sensitive data, including cryptographic keys, credentials residing in the LSASS process working set, and sensitive information from any active process memory space.\nThe flaw affects PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. The exploitation requires local access but does not require prior authentication or elevated privileges, representing a significant risk to system confidentiality and post-compromise security posture.",
  "technicalDetails": "The vulnerability resides in the IOCTL handler logic within the DirectIo64.sys kernel-mode driver. The driver exposes an interface that fails to perform adequate validation of user-supplied input parameters, specifically concerning file system paths and the operation requested via IOCTL.\nThe exploitation flow begins with the attacker opening a handle to the vulnerable device exposed by DirectIo64.sys. Once a handle is established, the attacker sends a specially crafted IOCTL request. This request includes an attacker-specified file path where the memory dump will be persisted. The driver, lacking sufficient input sanitization, accepts this path and proceeds to execute high-privilege kernel operations.\nInternally, the vulnerable code invokes the kernel function MmGetPhysicalMemoryRanges to identify all accessible physical memory segments. Following the identification of these ranges, the driver utilizes ZwMapViewOfSection to map the system's PhysicalMemory section object. By iterating through each page of the identified physical memory and utilizing the SYSTEM-level context of the driver, the software writes the raw contents of RAM directly to the file path specified by the attacker.\nBecause the operation is conducted in the SYSTEM context, the driver ignores the security descriptors that would normally prevent a non-privileged user from reading the entire physical memory address space. This bypasses the protections provided by the Windows Memory Manager and object manager for the PhysicalMemory section.\nThe resulting dump file acts as a complete snapshot of the system state. Post-exploitation impact is severe, as an attacker can perform offline analysis of the dump file using forensic tools (such as Volatility or WinDbg) to extract cleartext passwords, NTLM hashes, Kerberos tickets, API keys, and sensitive application data stored in RAM. The capability to exfiltrate LSASS process memory allows for trivial credential dumping, facilitating lateral movement and privilege escalation within the enterprise environment."
}