CyberRota Analysis
AI-GeneratedThe vulnerability affects PassMark PerformanceTest, BurnInTest, and OSForensics, allowing unauthenticated local attackers to exploit DirectIo64.sys to dump complete physical memory contents. By manipulating a file path in an IOCTL call, attackers can access sensitive information, including LSASS data and cryptographic material, with SYSTEM-level privileges, bypassing user-mode access controls. Organizations using these products should prioritize remediation to protect against potential data breaches and unauthorized access to critical system information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.