A high-severity information disclosure vulnerability in the PassMark DirectIo64.sys driver allows local attackers to extract sensitive system memory, including cryptographic material and LSASS data.

The DirectIo64.sys driver fails to implement proper access controls on its device object, allowing unauthenticated local users to interact with an exposed IOCTL to map and dump physical memory ranges.

This vulnerability presents a significant risk to system confidentiality by enabling the extraction of raw physical memory, including LSASS process memory. An attacker could capture credentials, encryption keys, and other sensitive information, leading to full account compromise or persistent access. Given the CVSS score of 7.8, this flaw represents a high risk to endpoints where these tools are deployed, as it bypasses standard user-mode security boundaries.

Immediate Action: Update to the latest versions of PerformanceTest (11.1 build 1012 or later), BurnInTest (11.1 build 1000 or later), and OSForensics (11.1 build 1016 or later) to receive the patched driver.

Proactive Monitoring: Monitor for unexpected execution of the PassMark driver or unusual file-writing activity originating from the driver service.

Compensating Controls: If immediate patching is not feasible, ensure that the affected services are disabled when not in use and restrict local user permissions to prevent unauthorized execution of code on the host.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the referenced security research.

This vulnerability constitutes a severe risk to host security by providing a mechanism for kernel-level memory extraction. Administrators should prioritize updating all affected PassMark products immediately to the specified build versions. Failure to remediate allows any local user to bypass user-mode ACLs and access critical system secrets, making timely patching essential to maintaining the integrity of the host environment.