A critical vulnerability in the PassMark DirectIo64.sys kernel driver allows local attackers to perform unauthorized privileged hardware operations, potentially leading to full system compromise.

The vulnerability exists because the DirectIo64.sys driver creates its device object without a security descriptor, resulting in a permissive default Windows access control list. This allows any unprivileged local user to open a handle to the device and issue malicious IOCTL commands to execute restricted kernel-level primitives.

Successful exploitation allows an unprivileged local user to escalate privileges to NT AUTHORITY\SYSTEM. By chaining physical memory read and write primitives, an attacker can disable endpoint protection, access sensitive memory structures such as the SAM and SECURITY hives, and maintain persistent access to the system. Given the CVSS score of 7.8, this represents a significant risk to the integrity and confidentiality of host systems.

Immediate Action: Update PerformanceTest to build 1012 or later, BurnInTest to build 1000 or later, and OSForensics to build 1016 or later. These updates modify the driver to enforce administrator-only access and implement signature checks for privileged operations.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or load the DirectIo64.sys driver and audit for processes attempting to interact with the device object.

Compensating Controls: Since this is a local privilege escalation, ensure that endpoint detection and response (EDR) solutions are configured to detect and block unauthorized kernel-mode activity and the loading of unsigned or suspicious drivers.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the technical write-up provided by the researcher (floppywiggler).

This vulnerability presents a high risk for local privilege escalation and potential kernel-level compromise. Administrators must prioritize updating all affected PassMark software installations immediately to the specified build versions to remediate the insecure driver configuration.