CVE-2025-52347
Kernel Memory Access in PassMark BurnInTest via IOCTL
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| passmark | burnintest | 11.0_build_1011 |
| passmark | osforensics | 11.1_build_1007 |
| passmark | performancetest | 11.1_build_1004 |
| passmark | burnintest | 11.0 |
| passmark | osforensics | 11.1 |
| passmark | performancetest | 11.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the DirectIo64.sys component of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004. It allows attackers to exploit a crafted IOCTL 0x8011E044 call to access kernel memory and escalate their privileges on the affected system.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain unauthorized access to kernel memory and escalate their privileges. This can lead to full control over the affected system, allowing them to execute arbitrary code, bypass security restrictions, and potentially cause significant damage or data compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in DirectIo64.sys allows attackers to access kernel memory and escalate privileges, which can lead to unauthorized access to sensitive data and system control.
Such unauthorized access and privilege escalation can compromise the confidentiality, integrity, and availability of data, potentially violating requirements under common standards and regulations like GDPR and HIPAA that mandate protection of sensitive personal and health information.
However, the provided information does not explicitly discuss the impact of this vulnerability on compliance with these standards or any specific regulatory implications.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the DirectIo64.sys kernel driver in specific PassMark products and is exploited via a crafted IOCTL call (0x8011E044) that allows access to kernel memory. Detection would involve monitoring for unusual or unauthorized IOCTL calls to this driver, especially the 0x8011E044 code.
Since the vulnerability is local and involves kernel driver IOCTL calls, detection commands could include checking for the presence and version of the vulnerable drivers and monitoring IOCTL usage.
- Use tools like Sysinternals' Process Monitor (ProcMon) to filter and log IOCTL calls to DirectIo64.sys, focusing on IOCTL code 0x8011E044.
- On Windows, use PowerShell or command line to check driver versions: `Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DriverName -like '*DirectIo64.sys*' }`
- Monitor system logs and security event logs for suspicious activity related to kernel driver access or privilege escalation attempts.
No specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the affected PassMark software to the latest patched versions where this vulnerability has been fixed.
The vulnerability has been addressed in recent updates of BurnInTest, OSForensics, and PerformanceTest, which include security enhancements to restrict DirectIO kernel device access.
- Apply the latest software updates or patches from PassMark for BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004.
- Restrict user permissions to prevent untrusted users from accessing or invoking the vulnerable IOCTL interface.
- Monitor and audit kernel driver access and privilege escalation attempts.
No other specific mitigation commands or steps are detailed in the provided resources.