A critical vulnerability in the PassMark DirectIo64.sys kernel driver allows local attackers to escalate privileges to kernel mode by exploiting hard-coded credentials and validation bypasses.

The DirectIo64.sys driver utilizes a hard-coded 8-byte key to authenticate IOCTL write requests and contains a secondary logic flaw that allows local, low-privileged users to bypass MAC verification, size checks, and Vendor ID verification entirely.

Successful exploitation allows a local attacker to execute arbitrary code within the Windows kernel, effectively granting them full control over the compromised machine. This bypasses standard user-mode security boundaries, potentially leading to total system compromise, credential theft from the kernel memory space, and the persistent installation of malicious software that is invisible to standard endpoint protection tools. Given the CVSS score of 7.8, this represents a high-severity risk that could facilitate lateral movement within a corporate network.

Immediate Action: Update PerformanceTest to build 1012 or later, BurnInTest to build 1000 or later, and OSForensics to build 1016 or later to replace the vulnerable DirectIo64.sys driver.

Proactive Monitoring: Monitor system logs for unauthorized attempts to interact with the DirectIo64.sys device object and audit endpoint protection alerts for kernel-level tampering or driver-loading anomalies.

Compensating Controls: Restrict local user access to sensitive directories and utilize kernel-mode code integrity policies to block the execution of unsigned or known-vulnerable drivers in the environment.

Public Exploit Available: Yes — proof-of-concept code and technical disclosure exist via the referenced GitHub repository and researcher write-ups.

Organizations utilizing affected PassMark software must prioritize the deployment of the vendor-provided updates to mitigate the risk of kernel-level exploitation. Because this flaw resides in a driver that functions at the highest privilege level, it is imperative to patch immediately to prevent local attackers from escalating their access to the Windows kernel.