A critical privilege escalation vulnerability in the PassMark DirectIo64.sys driver allows local attackers to gain kernel-level access and modify hardware configurations, posing a severe security risk.

The vulnerability exists within the DirectIo64.sys kernel driver, which fails to properly validate IOCTL requests and utilizes a permissive default access control list. This flaw allows a local, unprivileged user to interact with the driver and issue arbitrary kernel-level read/write commands.

Successful exploitation allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM, effectively gaining full control over the host operating system. This access can be used to disable security software, extract sensitive credentials from memory, or achieve persistent kernel-level code execution. With a CVSS score of 7.8, this vulnerability represents a high-severity threat to any environment where these tools are installed.

Immediate Action: Update all affected PassMark software to the latest versions, specifically PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later.

Proactive Monitoring: Monitor system logs for unauthorized attempts to load drivers or unusual access patterns involving the DirectIo64.sys file.

Compensating Controls: Ensure that endpoint protection software is configured to block or alert on the loading of unsigned or known vulnerable kernel drivers, and restrict local user rights to prevent the execution of unauthorized diagnostic tools.

Public Exploit Available: Yes — a public proof-of-concept exists as detailed in the researcher write-ups from GitHub (floppywiggler) and dkom.dev.

The presence of a signed, vulnerable kernel driver that provides arbitrary read and write access to kernel memory represents a classic bring-your-own-vulnerable-driver risk. Organizations must prioritize patching these applications to the specified versions immediately to prevent local privilege escalation. If patching is not immediately feasible, restrict the execution of these specific PassMark tools to highly trusted administrative users only.