Burnintest
Monthly
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) on Windows. A low-privileged local attacker can issue a single IOCTL call supplying an attacker-controlled output path, causing the driver to enumerate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a complete RAM image to disk in SYSTEM context and bypassing user-mode ACLs. Exposed data includes LSASS working-set memory, per-process heap contents, and in-use cryptographic keying material from all running processes. A public proof-of-concept is available at GitHub and no active exploitation (KEV) has been confirmed at time of analysis.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. A public proof-of-concept is available on GitHub, and vendor patches have been released for all three affected products.
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) on Windows. A low-privileged local attacker can issue a single IOCTL call supplying an attacker-controlled output path, causing the driver to enumerate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a complete RAM image to disk in SYSTEM context and bypassing user-mode ACLs. Exposed data includes LSASS working-set memory, per-process heap contents, and in-use cryptographic keying material from all running processes. A public proof-of-concept is available at GitHub and no active exploitation (KEV) has been confirmed at time of analysis.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. A public proof-of-concept is available on GitHub, and vendor patches have been released for all three affected products.
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.