CVE-2026-80114 in BurnInTest
Summary
by MITRE • 09/04/2026
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal in the distributed binary and computing valid MD5 authentication tags for arbitrary IOCTL write requests. Attackers can additionally bypass a secondary validation gate by using the driver's own bit-clear IOCTL to clear a single bit in the gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PassMark PerformanceTest prior to version 11.1 build 1012, BurnInTest prior to version 11.1 build 1000, and OSForensics prior to version 11.1 build 1016 represents a critical failure in driver-level security architecture within the DirectIo64.sys kernel module. This flaw stems from the improper handling of authentication mechanisms for input/output control codes directed at physical memory devices. The core issue lies in the presence of hard-coded credentials embedded directly into the binary distribution, specifically an eight-byte cryptographic key used to validate write operations. By extracting this static secret from the compiled driver file, a local attacker can generate valid Message Authentication Code tags using the MD5 hashing algorithm for arbitrary IOCTL write requests. This capability effectively neutralizes the intended integrity checks designed to prevent unauthorized modifications to system memory, allowing any process with local execution privileges to craft authenticated commands that bypass standard security boundaries.
The operational impact of this vulnerability is severe, as it grants attackers the ability to perform arbitrary physical memory writes from user space. In modern operating systems such as Microsoft Windows, direct access to physical memory is strictly restricted to kernel-mode drivers and highly privileged system processes due to its potential for destabilizing the entire system or escalating privileges. By exploiting the hard-coded key, an attacker can write data directly into critical areas of physical RAM, including but not limited to kernel structures, process control blocks, and security tokens. This capability facilitates privilege escalation attacks where a low-privileged user account can modify their own access token to gain SYSTEM-level rights, effectively compromising the entire host machine. Furthermore, such memory manipulation can be used to inject malicious code into running processes or disable security software by overwriting critical function pointers in memory.
A secondary and equally dangerous aspect of this vulnerability involves the bypassing of additional validation gates within the driver logic. The DirectIo64.sys implementation includes a specific IOCTL designed for bit-clear operations, which was intended for legitimate maintenance purposes but is exploited here to weaken subsequent security checks. By issuing a carefully crafted request that targets the gating instruction's displacement byte, an attacker can clear a single critical bit in memory. This modification alters the control flow of the driver such that all subsequent write requests skip essential verification steps, including MAC verification, size validation limits, and Vendor ID checks. Once this state is achieved, the driver effectively operates without any integrity or authorization controls for physical memory writes, creating an open channel for unrestricted kernel exploitation until the system is rebooted or the specific bit condition is reset through other means.
From a classification perspective, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it relies on secrets embedded in binary artifacts that are accessible to any user with read permissions. The exploitation technique maps closely to MITRE ATT&CK techniques T1055: Process Injection and T1068: Exploitation for Privilege Escalation, specifically leveraging direct kernel object manipulation via driver vulnerabilities. The ability to bypass integrity checks through memory modification also relates to CWE-94: Improper Control of Generation of Code (Code Injection) when considering the potential for code execution within privileged contexts.
Mitigation strategies must focus on immediate patching and architectural review. Users should update PassMark PerformanceTest, BurnInTest, and OSForensics to versions 11.1 build 1012 or later, where these hard-coded secrets have been removed and the authentication logic has been revised to prevent static key extraction. For organizations unable to immediately patch, restricting physical memory access through group policy settings such as DisableLockingPhysicalMemory can help mitigate some aspects of direct hardware manipulation, although this may impact legitimate diagnostic tools. Additionally, enforcing strict driver signing policies and monitoring for unusual IOCTL patterns directed at DirectIo64.sys via endpoint detection and response solutions can provide an additional layer of defense against exploitation attempts. Long-term remediation requires developers to adopt secure coding practices that avoid hard-coding secrets in binaries, instead utilizing dynamic key derivation or operating system-provided authentication mechanisms like Windows Driver Frameworks' built-in security features for kernel communication channels.