PassMark DirectIo64.sys CVE-2025-52347

PassMark BurnInTest 11.0 Build 1011 or earlier, OSForensics 11.1 Build 1007 or earlier, or PerformanceTest 11.1 Build 1004 or earlier must be installed on the target Windows system, which loads the vulnerable DirectIo64.sys kernel driver. Attacker requires local authenticated access with low-privilege user credentials (PR:L) - standard user account is sufficient, not administrator. The DirectIo64.sys driver must be loaded and accessible via DeviceIoControl API calls, which is the default state when PassMark tools are installed. No special configuration, non-default settings, or user interaction required beyond initial system access. Exploitation is limited to Windows platforms where these PassMark products are deployed, typically enterprise testing labs, IT diagnostic workstations, and digital forensics systems rather than general end-user devices.

Real-world risk is moderate-to-high for environments where PassMark tools are installed. The CVSS score of 7.8 accurately reflects the local attack vector (AV:L) requiring low-privileged authenticated access (PR:L), but delivers complete system compromise (C:H/I:H/A:H) with low attack complexity (AC:L) and no user interaction (UI:N). The GitHub repository contains proof-of-concept code, significantly lowering exploitation barriers for attackers with initial foothold access. However, absence from CISA KEV suggests this is not yet exploited in broad campaigns, likely due to the niche deployment of PassMark utilities primarily in enterprise IT departments, testing labs, and forensics environments. The attack requires local authenticated access, limiting opportunistic remote exploitation but making it highly valuable in post-exploitation scenarios, lateral movement, or insider threat contexts. Organizations using these PassMark products should prioritize patching, especially on systems accessible to multiple users or in environments with privilege separation requirements. The specific IOCTL control code (0x8011E044) is publicly documented in the POC, enabling easy weaponization.

A penetration tester or malicious insider with standard user credentials on a Windows workstation running PassMark PerformanceTest gains initial access through phishing or stolen credentials. They download the publicly available POC from the researcher's GitHub repository and execute the exploit code, which sends a specially crafted IOCTL 0x8011E044 request to the DirectIo64.sys driver. The vulnerable driver fails to validate the IOCTL parameters, allowing the attacker to read sensitive kernel memory and leverage this access to inject code into a SYSTEM-level process, escalating from limited user to full administrative control of the machine and potentially pivoting to other systems on the network.