CVE-2026-80117 in BurnInTest
Summary
by MITRE • 09/04/2026
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist or port validation on exposed IOCTLs. Attackers can obtain a device handle and write to sensitive ports including the PS/2 controller port, CPU reset ports, CMOS configuration ports, and interrupt controller ports to cause an immediate system reset or other hardware-level manipulation from a standard user account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PassMark PerformanceTest versions prior to 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 represents a critical failure in kernel-mode driver security within the DirectIo64.sys component. This flaw stems from an insufficient validation mechanism for input/output control codes exposed to user-space applications. Specifically, the driver fails to implement an allowlist or perform rigorous port range validation when handling IOCTL requests that facilitate direct hardware access via x86 IN and OUT instructions. In standard operating system architectures, such low-level I/O operations are strictly privileged actions reserved for kernel-mode code due to their potential to bypass memory protection boundaries and interact directly with hardware registers. By exposing these capabilities through a driver without adequate safeguards, the software inadvertently creates a bridge that allows unprivileged local users to execute commands typically restricted to administrators or the operating system core itself.
From an operational perspective, this lack of validation enables any authenticated user on the affected systems to obtain a handle to the device and subsequently issue arbitrary IN and OUT instructions targeting specific x86 I/O ports. The impact is severe because it grants attackers access to sensitive hardware interfaces that are critical for system stability and configuration. Attackers can target the PS/2 controller port, which manages input from keyboards and mice, potentially allowing for keystroke injection or device manipulation at a level below standard operating system monitoring tools. Furthermore, the ability to write to CPU reset ports allows an attacker to trigger immediate hardware-level resets of the processor, effectively causing a denial of service by forcing the machine to reboot unexpectedly. Additionally, access to CMOS configuration ports and interrupt controller ports enables modifications to fundamental system settings or disruption of hardware interrupts, which can lead to system instability, data corruption, or further privilege escalation vectors depending on the specific port accessed and the state of the system at the time of exploitation.
This vulnerability aligns with CWE-250, as it involves execution with unnecessary privileges, allowing a lower-privileged user to perform actions that should be restricted to higher-privilege entities. It also relates closely to CWE-732, which pertains to incorrect permission assignment for critical resources, specifically the hardware I/O ports in this context. In terms of threat modeling and adversary behavior, this flaw facilitates techniques categorized under MITRE ATT&CK T1059, Command and Scripting Interpreter, particularly when used as a precursor to more advanced attacks such as T1053 Scheduled Task/Job or T1234 Host-based Policy Modification if the attacker leverages the hardware manipulation for persistence or evasion. The ability to reset CPUs or modify interrupt controllers can also be seen as an enabler for physical layer disruptions, mapping towards aspects of T1499 Endpoint Denial of Service, although executed through software exploitation rather than direct physical tampering.
Mitigation strategies must focus on immediate remediation and architectural hardening. Users should upgrade PassMark PerformanceTest to version 11.1 build 1012 or later, BurnInTest to version 11.1 build 1000 or later, and OSForensics to version 11.1 build 1016 or later, as these versions contain the necessary fixes for input validation in DirectIo64.sys. For environments where immediate patching is not feasible, restricting user access to applications that require kernel-mode driver interaction can reduce the attack surface. Additionally, implementing strict application whitelisting policies and monitoring for unusual IOCTL calls directed at system drivers can help detect exploitation attempts. Security administrators should also ensure that BIOS/UEFI settings are configured to limit hardware configuration changes from within the operating system where possible, adding an additional layer of defense against CMOS manipulation attacks. Regular auditing of driver installations and ensuring they originate from trusted vendors is essential to prevent similar vulnerabilities in future software deployments.