CVE-2026-80118: PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in the SYSTEM context, allowing a standard user to create files in locations they cannot otherwise write and to recover memory belonging to processes of other users. The image is preceded by a header that exposes the kernel loaded-module list, active-process list and PFN database pointers, defeating KASLR. The same handler also dereferences the return value of an internal kernel-structure locator without a NULL check; that locator returns NULL on three distinct failure paths, and a kernel crash results on builds where any of those paths is taken.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A standard unprivileged local user can reach the affected DirectIo64.sys IOCTL. No caller-identity check is performed, so administrative privileges are not required.
What does an attacker need to do to obtain sensitive memory contents?
The attacker needs local code execution and the ability to issue the relevant IOCTL to DirectIo64.sys with a caller-supplied output file path. The driver runs in the SYSTEM context and writes a crash-dump-format image of physical memory to that path.
What information can be exposed by the generated memory image?
The image can contain physical memory belonging to processes of other users. Its header also exposes pointers to the kernel loaded-module list, active-process list, and PFN database, defeating KASLR.
Which releases should be considered affected?
Affected releases are PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. Systems running an earlier release of the relevant product should be updated to at least the stated build.
Can this issue also cause a system crash?
Yes. The IOCTL handler dereferences an internal locator result without checking for NULL, and a kernel crash occurs when any of the locator's three NULL-return failure paths is taken.