CVE-2026-80116 in BurnInTest
Summary
by MITRE • 09/04/2026
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PassMark PerformanceTest prior to version 11.1 build 1012, BurnInTest prior to version 11.1 build 1000, and OSForensics prior to version 11.1 build 1016 stems from a critical flaw within the DirectIo64.sys driver component. This kernel-mode driver exposes input/output control codes that facilitate direct hardware access but lacks essential security controls during request processing. Specifically, the implementation fails to validate device selection parameters, register offsets, or write values before executing operations against PCI configuration spaces. This absence of boundary checking and authorization logic allows any local user with sufficient privileges to interact directly with low-level system resources without proper restriction mechanisms in place.
From a technical perspective, the core issue lies in the insufficient validation of IOCTL requests targeting the PCI subsystem. The driver permits arbitrary read and write operations into the PCI configuration space, which is typically reserved for privileged processes or kernel components responsible for hardware enumeration and management. By exploiting these exposed interfaces, an attacker can manipulate critical registers that control device behavior. For instance, they can enable Bus Master Direct Memory Access on any PCI device attached to the system bus. This capability effectively bypasses standard memory protection boundaries because devices with Bus Master DMA enabled can read from and write to arbitrary physical memory locations without CPU intervention or operating system mediation.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and data integrity compromise. An attacker leveraging these flaws can halt storage controller input/output operations by clearing command registers, leading to denial-of-service conditions that disrupt critical system functions such as disk I/O performance or complete system hangs depending on the targeted device. More critically, the ability to remap Base Address Registers allows an adversary to redirect DMA transactions to physical addresses chosen at will. This mechanism enables unauthorized memory reads and writes across protected regions of RAM, facilitating the extraction of sensitive credentials, kernel data structures, or other confidential information stored in user-mode applications that are normally isolated from direct hardware access.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write when considering the potential for memory corruption through DMA redirection. In terms of attack tactics, it maps to MITRE ATT&CK techniques including T1059 Command and Scripting Interpreter if used in conjunction with other exploits, but more directly relates to T1063 Virtualization/Sandbox Evasion via hardware-assisted persistence or data exfiltration methods like T1074 Data Staged. The exploitation path typically involves local access followed by privilege escalation through kernel manipulation rather than remote code execution vectors.
Mitigation strategies primarily involve updating the affected software products to versions where these IOCTL handlers have been hardened with proper input validation and permission checks. System administrators should ensure that DirectIo64.sys is updated or removed if not strictly required for specific benchmarking tasks, as direct hardware access drivers present a significant attack surface reduction opportunity when disabled. Additionally, enabling IOMMU features such as Intel VT-d or AMD-Vi on supported platforms can provide hardware-level isolation of DMA transactions, preventing devices from accessing arbitrary physical memory even if Bus Master DMA is enabled via software manipulation. Regular auditing of installed kernel-mode drivers and restricting local administrative privileges further reduces the risk surface associated with this class of vulnerabilities.