Executive brief
PassMark's DirectIo64.sys kernel driver, used in PerformanceTest, BurnInTest, and OSForensics to access hardware performance metrics, contains a privilege escalation flaw. A standard user can exploit this to execute arbitrary I/O port commands (IN/OUT instructions) to any x86 port, including those controlling system reset, CMOS settings, and interrupt controllers, enabling immediate system resets or other low-level hardware manipulation without administrator privileges.
Technical details
The vulnerability is a privilege escalation in the DirectIo64.sys kernel driver due to missing port validation and allowlisting on exposed IOCTLs. The driver creates a device object with a permissive default DACL (FILE_GENERIC_READ | FILE_GENERIC_WRITE | FILE_GENERIC_EXECUTE for Everyone) and no token or integrity checks on callers. An unprivileged local user (medium integrity) can open the device and submit arbitrary I/O port commands; the dispatcher validates neither the port address nor the instruction type. Attack preconditions include local code execution and the device being openable (either the driver running as a service without an exclusive handle, or code executing in the elevated application process). The fix involves enforcing an allowlist of safe ports and restricting device access via a stricter security descriptor (IoCreateDeviceSecure). Patches are available in PerformanceTest 11.1 build 1012+, BurnInTest 11.1 build 1000+, and OSForensics 11.1 build 1016+.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-08-28: disclosed: Technical disclosure published at dkom.dev
- 2026-09-04: advisory: NVD published CVE-2026-80117
- 2026-09-04: patched: Patches available in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016