CVE-2026-80119 in BurnInTest
Summary
by MITRE • 09/04/2026
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in PassMark PerformanceTest prior to version 11.1 build 1012, BurnInTest prior to version 11.1 build 1000, and OSForensics prior to version 11.1 build 1016 represents a critical information disclosure flaw within the DirectIo64.sys driver component. This issue stems from an improper implementation of input validation for IOCTL (Input/Output Control) requests exposed by the kernel-mode driver. Specifically, the vulnerability allows unauthenticated local attackers to interact with the driver without requiring prior authentication or elevated privileges on the affected system. By supplying a caller-controlled file path as part of the IOCTL request, an attacker can exploit this misconfiguration to trigger arbitrary memory operations that bypass standard user-mode access control mechanisms. The core technical flaw lies in the driver's failure to restrict which physical memory ranges can be accessed and how those accesses are mapped into the process address space, effectively turning a diagnostic or testing utility into a potent tool for full system memory extraction.
From a technical perspective, the exploitation mechanism relies on the Windows kernel API functions MmGetPhysicalMemoryRanges and ZwMapViewOfSection. When an attacker issues the specific IOCTL call with a maliciously crafted file path parameter, the vulnerable driver invokes MmGetPhysicalMemoryRanges to enumerate all available physical memory ranges in the system. Subsequently, it utilizes ZwMapViewOfSection on the PhysicalMemory section object to map each of these pages directly into the address space associated with the attacker's process or writes them out via the provided path. Because this operation is executed within the context of the SYSTEM account due to the nature of kernel-mode drivers and their typical service configurations, the resulting memory dump contains sensitive data that would otherwise be protected by user-level security boundaries. This includes the working set of critical system processes such as LSASS (Local Security Authority Subsystem Service), which holds credentials for active logon sessions, as well as the full process memory images and cryptographic material from all running applications.
The operational impact of this vulnerability is severe, leading to a complete compromise of confidentiality across the entire operating environment. An attacker who successfully exploits this flaw can obtain a raw image of physical RAM, enabling them to extract plaintext passwords, Kerberos tickets, NTLM hashes, encryption keys, and other sensitive secrets stored in memory by legitimate processes. This capability effectively neutralizes many security controls that rely on obfuscation or isolation at the user mode level, as kernel-mode drivers operate with higher privileges than standard applications. The ability to dump LSASS process memory is particularly dangerous because it provides immediate access to authentication credentials for all users currently logged into the system, facilitating lateral movement and privilege escalation in enterprise environments. This aligns closely with CWE-200, which classifies this as an Information Exposure vulnerability, where sensitive information is disclosed to unauthorized actors without explicit authorization.
In terms of threat modeling and attack classification, this behavior maps directly to MITRE ATT&CK technique T1003.001, known as OS Credential Dumping: LSASS Memory. The exploitation path described involves direct interaction with kernel objects to extract credential material from protected process memory spaces. Furthermore, the use of an IOCTL interface for such operations relates to CWE-787, which covers out-of-bounds write vulnerabilities if improper bounds checking leads to unintended memory access patterns, although in this specific case, the primary concern is unauthorized read access and data exfiltration rather than code execution or integrity violation. The vulnerability highlights the risks associated with third-party kernel drivers that may not adhere strictly to least privilege principles or fail to validate input parameters against expected constraints before performing high-impact system operations.
Mitigation strategies for this vulnerability primarily involve updating the affected software products to their patched versions, specifically PassMark PerformanceTest 11.1 build 1012 or later, BurnInTest 11.1 build 1000 or later, and OSForensics 11.1 build 1016 or later. These updates presumably include fixes that restrict the IOCTL functionality to prevent unauthorized memory mapping or remove the exposed interface entirely if it is not essential for standard operation. In environments where immediate patching is not feasible, administrators should consider disabling or removing the DirectIo64.sys driver if it is no longer required by legacy applications. Additionally, implementing strict device control policies through endpoint detection and response solutions can help block unauthorized interactions with kernel drivers that exhibit suspicious IOCTL patterns. Regular auditing of installed third-party drivers and ensuring they are from trusted vendors with robust security practices remains a critical defense-in-depth measure against such information disclosure risks.