Executive brief
PassMark PerformanceTest, BurnInTest, and OSForensics include a signed hardware-access driver with hardcoded credentials embedded in its binary. An attacker with local access can extract this key and forge authentication tags to perform arbitrary physical memory writes, potentially compromising system security and enabling privilege escalation. The driver also contains a secondary bypass that allows attackers to disable additional validation checks entirely.
Technical details
The vulnerability resides in DirectIo64.sys, a signed kernel driver shipped with PassMark's benchmarking and forensics tools. The driver implements MAC-based authentication using an 8-byte key hardcoded as a literal in the distributed binary; attackers can extract this key and compute valid MD5 authentication tags for arbitrary IOCTL write requests that perform physical memory operations. A secondary bypass exists via a bit-clear IOCTL that modifies a gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely. The device is created without a restrictive security descriptor (IoCreateDevice rather than IoCreateDeviceSecure), allowing any medium-integrity process to open it. The attack requires local access and the ability to open the device; while PassMark applications hold an exclusive handle during normal use, the underlying ACL permits unprivileged access when the driver is loaded as a service or from within an elevated process. Patches are available in PerformanceTest 11.1 build 1012 and later.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-09-04: disclosed: CVE-2026-80114 published
- 2026-08-28: other: Technical analysis published on dkom.dev