Executive brief
PassMark's DirectIo64.sys is a hardware access driver shipped with PerformanceTest, BurnInTest, and OSForensics benchmarking tools. The driver is vulnerable to local privilege escalation because it permits unauthenticated access to perform arbitrary PCI device configuration and memory operations. An attacker can modify hardware settings, disable storage controllers, or redirect memory access to cause system instability or data theft.
Technical details
The vulnerability is a privilege escalation in DirectIo64.sys (a signed Windows kernel driver) caused by insufficient input validation on IOCTL handlers and an overly permissive device security descriptor. The driver is created with no DACL, defaulting to an ACL that allows any medium-integrity process to open it for read/write access. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations without validation on device selection, register offset, or value. This enables Bus Master DMA enablement on any PCI device, storage controller I/O disruption via command register clearing, or Base Address Register remapping to redirect DMA to attacker-controlled physical addresses. Successful exploitation requires local code execution at medium integrity or above; the device must be openable (either not held exclusively, or exploited from within an elevated PassMark process). Patches are available in PassMark PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-09-04: disclosed: CVE-2026-80116 published; disclosure analysis at dkom.dev on 2026-08-28
- 2026: patched: Patches available in PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, OSForensics 11.1 build 1016+