Cpe:2.3:a:passmark:performancetest:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apassmarkperformancetest/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 19:27:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal Privilege Escalation in PassMark Software Drivershttps://feed.craftedsignal.io/briefs/2026-09-passmark-privilege-escalation/Fri, 04 Sep 2026 19:27:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-passmark-privilege-escalation/PassMark PerformanceTest, BurnInTest, and OSForensics contain a vulnerability in the DirectIo64.sys driver that allows local users to clear arbitrary physical memory bits, enabling privilege escalation.PassMark Software has disclosed a privilege escalation vulnerability affecting PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). The flaw resides in the DirectIo64.sys driver, which exposes an IOCTL handler that fails to validate the physical address parameter. A local attacker can gain a device handle to the driver and invoke MmMapIoSpace with a user-supplied 64-bit physical address and bit index. By clearing bits in critical kernel code pages or page table entries, an attacker can modify kernel-level structures to achieve local privilege escalation. This vulnerability represents a significant risk for systems where these forensic and testing tools are installed, as they often run with high privileges.

Attack Chain

  1. Attacker gains low-privileged local access to a Windows system where affected PassMark software is installed.
  2. Attacker enumerates the device driver DirectIo64.sys to obtain a handle for communication.
  3. Attacker identifies the specific IOCTL handler within the driver that facilitates physical memory interaction.
  4. Attacker constructs a malicious payload containing an arbitrary 64-bit physical address and a targeted bit index.
  5. Attacker sends the IOCTL request to the driver to invoke the vulnerable MmMapIoSpace function.
  6. The driver processes the request without validating the address range, clearing the specified bits in kernel memory.
  7. Attacker triggers a modification to a page table entry or kernel code page to overwrite security-sensitive data structures.
  8. Attacker gains elevated (SYSTEM) privileges on the local machine.

Impact

Successful exploitation allows local attackers to bypass Windows security controls, resulting in full system compromise. This impact is critical in enterprise environments where forensic or testing tools are deployed on sensitive endpoints.

Recommendation

  1. Upgrade PassMark PerformanceTest to build 1012 or later, BurnInTest to build 1000 or later, and OSForensics to build 1016 or later immediately.
  2. Audit for the existence of DirectIo64.sys across the enterprise to identify vulnerable hosts.
  3. Restrict access to diagnostic and forensic tools to authorized administrators only.
]]>highadvisoryprivilege-escalationwindowskernel-vulnerability