Privilege Escalation and DoS in PassMark PerformanceTest

Executive Summary

This vulnerability is a privilege escalation and denial-of-service issue in PassMark PerformanceTest, BurnInTest, and OSForensics before versions 11.1 build 1012, 11.1 build 1000, and 11.1 build 1016 respectively. It involves a driver file DirectIo64.sys that exposes insecure IOCTLs allowing local attackers to read or write to Model-Specific Registers (MSRs) without proper restrictions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of vulnerable PassMark software versions and monitoring for suspicious activity related to DirectIo64.sys. Inspect installed versions of PerformanceTest, BurnInTest, or OSForensics and ensure they are updated beyond 11.1 build 1012, 1000, or 1016 respectively. Check for unauthorized modifications to MSRs or kernel crashes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash the system by zeroing out the system call handler MSR, causing an immediate unrecoverable kernel crash. They could also read sensitive MSRs to locate critical kernel data structures, potentially leading to further exploitation or information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to crash the kernel or read sensitive system registers, which could lead to unauthorized access or system instability. Such impacts may violate compliance requirements for data protection and system integrity in standards like GDPR and HIPAA, as they could result in unauthorized data access or service disruptions.

Useful 0 Not Useful 0

Mitigation Strategies

Update PassMark PerformanceTest to version 11.1 build 1012 or later, BurnInTest to version 11.1 build 1000 or later, and OSForensics to version 11.1 build 1016 or later to address the vulnerability in DirectIo64.sys.

Useful 0 Not Useful 0