Executive Summary

This vulnerability exists in the DirectIo64.sys component of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004. It allows attackers to exploit a crafted IOCTL 0x8011E044 call to access kernel memory and escalate their privileges on the affected system.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain unauthorized access to kernel memory and escalate their privileges. This can lead to full control over the affected system, allowing them to execute arbitrary code, bypass security restrictions, and potentially cause significant damage or data compromise.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in DirectIo64.sys allows attackers to access kernel memory and escalate privileges, which can lead to unauthorized access to sensitive data and system control.

Such unauthorized access and privilege escalation can compromise the confidentiality, integrity, and availability of data, potentially violating requirements under common standards and regulations like GDPR and HIPAA that mandate protection of sensitive personal and health information.

However, the provided information does not explicitly discuss the impact of this vulnerability on compliance with these standards or any specific regulatory implications.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the DirectIo64.sys kernel driver in specific PassMark products and is exploited via a crafted IOCTL call (0x8011E044) that allows access to kernel memory. Detection would involve monitoring for unusual or unauthorized IOCTL calls to this driver, especially the 0x8011E044 code.

Since the vulnerability is local and involves kernel driver IOCTL calls, detection commands could include checking for the presence and version of the vulnerable drivers and monitoring IOCTL usage.

• Use tools like Sysinternals' Process Monitor (ProcMon) to filter and log IOCTL calls to DirectIo64.sys, focusing on IOCTL code 0x8011E044.
• On Windows, use PowerShell or command line to check driver versions: `Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DriverName -like '*DirectIo64.sys*' }`
• Monitor system logs and security event logs for suspicious activity related to kernel driver access or privilege escalation attempts.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the affected PassMark software to the latest patched versions where this vulnerability has been fixed.

The vulnerability has been addressed in recent updates of BurnInTest, OSForensics, and PerformanceTest, which include security enhancements to restrict DirectIO kernel device access.

• Apply the latest software updates or patches from PassMark for BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004.
• Restrict user permissions to prevent untrusted users from accessing or invoking the vulnerable IOCTL interface.
• Monitor and audit kernel driver access and privilege escalation attempts.

No other specific mitigation commands or steps are detailed in the provided resources.

Useful 0 Not Useful 0