Emil Sørbrøden

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** An improper access control issue exists in the `DirectIo64.sys` kernel driver. The driver creates a device object without a security descriptor, allowing unprivileged local users to open a handle to it. This enables attackers to issue IOCTLs (Input/Output Control codes used by applications to communicate with device drivers) through the permissive default Windows ACL (Access Control List) to perform privileged hardware operations, regardless of their privilege or integrity level. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** A privilege escalation issue exists in the DirectIo64.sys driver. The flaw stems from missing validation of the physical address parameter within an exposed IOCTL handler. A local attacker can obtain a device handle and provide an arbitrary 64-bit physical address along with a bit index to trigger the `MmMapIoSpace` function. This allows the attacker to clear arbitrary bits at any physical memory address, including kernel code pages or page table entries, which can lead to local privilege escalation or full system compromise. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** The `DirectIo64.sys` driver contains hard-coded credentials. Local attackers can extract an 8-byte key embedded as a literal in the binary to compute valid MD5 authentication tags for arbitrary IOCTL write requests, enabling arbitrary physical memory writes. Furthermore, attackers can bypass secondary validation gates by using the driver's bit-clear IOCTL to modify a bit in the gating instruction's displacement byte. This action causes subsequent write requests to bypass MAC verification, size checks, and Vendor ID checks. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** A privilege escalation and denial-of-service issue exists in the `DirectIo64.sys` driver. Local attackers can exploit exposed IOCTLs (Input/Output Control codes) due to insufficient blocklist enforcement to read arbitrary Model-Specific Registers (MSRs) or write zero to any MSR. Model-Specific Registers are system registers used for toggling and monitoring specific processor features. By using the unrestricted write IOCTL, an attacker can zero out the system call handler MSR, leading to an immediate unrecoverable kernel crash upon the next system call, or read security-sensitive MSRs to locate kernel data structures. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** A privilege escalation issue exists in the `DirectIo64.sys` driver. Local users can modify hardware configuration by exploiting exposed IOCTLs (Input/Output Control codes used by applications to communicate with device drivers) that lack validation on device selection, register offset, or value. By obtaining a device handle, an attacker can perform arbitrary PCI configuration space read/write operations. This allows for enabling Bus Master DMA (Direct Memory Access, which lets hardware devices access system memory independently of the CPU) on any PCI device, halting storage controller I/O by clearing command registers, or remapping Base Address Registers to redirect DMA to a physical address chosen by the attacker. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** A privilege escalation issue exists in the `DirectIo64.sys` driver. Local users can issue arbitrary IN and OUT instructions to any x86 I/O port because the exposed IOCTLs (Input/Output Control codes used by applications to communicate with device drivers) lack an allowlist or port validation. By obtaining a device handle, an attacker can write to sensitive ports, such as the PS/2 controller port, CPU reset ports, CMOS configuration ports, and interrupt controller ports, enabling hardware-level manipulation or an immediate system reset from a standard user account. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** An unauthenticated physical memory disclosure exists in the `DirectIo64.sys` driver. Unprivileged local users can trigger this via a single IOCTL (Input/Output Control) request that lacks caller-identity checks. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a file path provided by the caller using the SYSTEM context. This allows a standard user to create files in restricted locations and recover memory from other users' processes. Additionally, the image includes a header exposing the kernel loaded-module list, active-process list, and PFN (Page Frame Number) database pointers, which defeats KASLR (Kernel Address Space Layout Randomization), a security feature that randomizes the memory addresses used by the kernel. The same handler also fails to perform a NULL check on the return value of an internal kernel-structure locator, which can lead to a kernel crash if the locator returns NULL on specific failure paths. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.

**Name of the Vulnerable Software and Affected Versions** PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 **Description** An information disclosure issue exists in the DirectIo64.sys driver. Unauthenticated local attackers can dump the complete contents of physical memory by providing a caller-controlled file path to an exposed IOCTL (Input/Output Control). The attack involves a single IOCTL call that triggers the driver to iterate through all physical memory ranges using the `MmGetPhysicalMemoryRanges` function and map each page via `ZwMapViewOfSection` on the PhysicalMemory section object. This process writes a full RAM image to a specified path within the SYSTEM context, bypassing user-mode Access Control Lists (ACLs) and exposing the LSASS working set, process memory, and cryptographic material from all active processes. **Recommendations** Update PassMark PerformanceTest to version 11.1 build 1012 or later. Update BurnInTest to version 11.1 build 1000 or later. Update OSForensics to version 11.1 build 1016 or later.