Executive brief
PassMark's DirectIo64.sys driver, bundled with PerformanceTest, BurnInTest, and OSForensics, contains a vulnerability that allows local users to dump the entire system's physical memory contents. An attacker can extract sensitive data from all running processes—including passwords stored in memory (LSASS), encryption keys, and other confidential information—by issuing a single command to the driver with a file path where they want the memory image saved. This bypasses normal Windows security restrictions and runs with system privileges, exposing critical data even from administrator-protected processes.
Technical details
The vulnerability is an information disclosure flaw in the DirectIo64.sys signed driver stemming from improper access control and unsafe IOCTL handling. The root cause is that the driver creates its device object without a security descriptor (using IoCreateDevice instead of IoCreateDeviceSecure), leaving it accessible to any user at medium integrity or above. An unauthenticated local attacker can open a handle to the device and issue a specially crafted IOCTL that triggers the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges, map each page to the PhysicalMemory section object using ZwMapViewOfSection, and write a complete RAM dump to an attacker-specified file path. The dump executes in SYSTEM context, circumventing user-mode access controls and exposing LSASS working set, process memory, and cryptographic material from all running processes. Attack preconditions are minimal: local access, medium integrity (standard user), and the device being accessible (not held exclusively by a PassMark product). Patches are available in PerformanceTest 11.1 build 1012, BurnInTest 11.1 build 1000, and OSForensics 11.1 build 1016.
Affected products
- PassMark PerformanceTest before 11.1 build 1012
- PassMark BurnInTest before 11.1 build 1000
- PassMark OSForensics before 11.1 build 1016
Timeline
- 2026-09-04: disclosed: CVE-2026-80119 disclosed
- 2026-08-28: other: Technical deep-dive published on dkom.dev