Executive brief
PassMark's DirectIo64.sys is a signed kernel driver used by PerformanceTest, BurnInTest, and OSForensics to provide hardware access for benchmarking and diagnostics. The driver creates a device object without proper security restrictions, allowing any unprivileged user to perform privileged hardware operations—such as reading CPU temperatures, accessing memory, and probing the PCI bus—that should be restricted to administrators. An attacker can exploit this to gain unauthorized access to sensitive hardware information or perform low-level system manipulation.
Technical details
The vulnerability is an improper access control flaw in the DirectIo64.sys kernel driver. The driver creates a device object using IoCreateDevice without specifying a security descriptor, causing Windows to apply a permissive default DACL that grants FILE_GENERIC_READ, FILE_GENERIC_WRITE, and FILE_GENERIC_EXECUTE permissions to all users (Everyone group). An unprivileged local attacker with medium integrity level or above can open a handle to the device and issue IOCTLs to access restricted hardware operations without any privilege or integrity checks. The vulnerability is present in PassMark PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016; remediation requires using IoCreateDeviceSecure with a proper security descriptor. A partial mitigation (exclusive handle holding) was implemented at build b1005 but does not prevent exploitation when the driver is loaded as a service or when code executes within the product's elevated process.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-08-28: disclosed: Technical analysis published at dkom.dev
- 2026-09-04: advisory