Executive brief
PassMark's DirectIo64.sys is a signed kernel driver used by PerformanceTest, BurnInTest, and OSForensics to provide privileged hardware access. The driver fails to properly validate or restrict access to IOCTLs that read and write Model-Specific Registers (MSRs), allowing unprivileged local users to crash the system or extract sensitive kernel data. An attacker can trigger an immediate kernel panic by zeroing the system call handler MSR, or read security-sensitive MSRs to locate kernel structures for further exploitation.
Technical details
The vulnerability is a privilege escalation and denial-of-service flaw in the DirectIo64.sys kernel driver, a signed hardware-access shim bundled with PassMark tools. The driver creates a device object with a permissive default DACL (0x1201bf grants FILE_GENERIC_READ|WRITE|EXECUTE to Everyone), and the IOCTL dispatcher has no per-request token, integrity level, or allowlist checks on MSR read/write operations. An unprivileged local attacker can open the device and directly invoke IOCTLs to read arbitrary MSRs (exposing kernel data structure locations) or write zero to any MSR. Writing zero to the system call handler MSR (IA32_LSTAR) immediately crashes the kernel on the next system call. The attack requires local code execution at medium integrity or above, but is otherwise unrestricted. Patches were released in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016 with an updated security descriptor (SDDL change) and increased blocklist enforcement.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-09-04: disclosed: CVE-2026-80115 published on NVD
- 2026-08-28: advisory: Technical disclosure and analysis published on dkom.dev
- 2025-04-15: other: Vulnerable DirectIo64.sys binary compiled and shipped in PerformanceTest 11.1 build 1008 and earlier