Executive brief
PassMark's DirectIo64 driver is a hardware-access component shipped with PerformanceTest, BurnInTest, and OSForensics that allows these applications to access low-level system information like memory timings and temperature sensors. The driver fails to validate physical memory addresses passed through certain system calls, allowing an unprivileged local user to modify arbitrary system memory locations and escalate privileges or compromise the entire system.
Technical details
This is a privilege escalation vulnerability in DirectIo64.sys, a signed kernel driver shipped with PassMark products. The vulnerability stems from missing validation of the physical address parameter in an exposed IOCTL handler—when a user opens a device handle to the driver, they can invoke the handler with an arbitrary 64-bit physical address and bit index. The driver then calls MmMapIoSpace and clears bits at that address without validating whether it points to kernel code pages or page table entries. No authentication or integrity-level checks gate access to the IOCTL dispatcher; the driver uses a permissive default security descriptor that allows any medium-integrity process to open it for read and write. An attacker can supply carefully crafted physical addresses to corrupt kernel code or page tables, achieving local privilege escalation. Patches are available: PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, OSForensics 11.1 build 1016+.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-08-28: disclosed: Technical analysis published at dkom.dev
- 2026-09-04: advisory: CVE-2026-80113 published on NVD