CVE-2025-52347 Overview
CVE-2025-52347 is a local privilege escalation vulnerability in the DirectIo64.sys driver bundled with multiple PassMark products. The flaw affects PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004. An authenticated local attacker can issue a crafted IOCTL 0x8011E044 call to access kernel memory and escalate privileges to SYSTEM. The weakness maps to [CWE-20: Improper Input Validation], reflecting insufficient validation of user-supplied data passed to a privileged kernel-mode driver.
Critical Impact
A local low-privileged user can escalate to SYSTEM by abusing an exposed IOCTL handler in DirectIo64.sys, granting full kernel-level read and write access on affected hosts.
Affected Products
- PassMark BurnInTest v11.0 Build 1011
- PassMark OSForensics v11.1 Build 1007
- PassMark PerformanceTest v11.1 Build 1004
Discovery Timeline
- 2026-05-01 - CVE-2025-52347 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2025-52347
Vulnerability Analysis
The DirectIo64.sys kernel driver ships with several PassMark utilities to provide low-level hardware access. The driver exposes an IOCTL interface that user-mode processes can call through DeviceIoControl. The handler for IOCTL code 0x8011E044 does not adequately validate the input buffer or the resulting memory operation, allowing arbitrary kernel memory to be read or written. Because the driver runs in kernel mode at ring 0, successful exploitation yields full control of the operating system kernel and a path to NT AUTHORITY\SYSTEM execution.
Root Cause
The root cause is improper input validation [CWE-20] in the IOCTL dispatch routine of DirectIo64.sys. The driver trusts pointer or length values supplied from user mode without enforcing kernel-mode boundary checks. This pattern is common in legacy hardware-access drivers that intentionally expose physical memory or model-specific register operations to user space without applying ACL-style restrictions to the device object.
Attack Vector
Exploitation requires local code execution with low privileges. An attacker opens a handle to the driver's device object and issues a DeviceIoControl call using IOCTL 0x8011E044 with a crafted input buffer. The driver then performs an unchecked kernel memory operation on behalf of the caller. By chaining read and write primitives, attackers can overwrite token privileges, replace the EPROCESS token, or hook kernel structures to gain SYSTEM. The vulnerability cannot be triggered remotely and requires no user interaction beyond the attacker's own session.
No public proof-of-concept code has been verified for this CVE. Technical details are available in the GitHub Vulnerability Disclosure.
Detection Methods for CVE-2025-52347
Indicators of Compromise
- Presence of DirectIo64.sys loaded by processes that are not the legitimate PassMark binaries (BurnInTest.exe, OSF64.exe, PerformanceTest.exe).
- Creation of handles to the DirectIo64 device object by unexpected user-mode processes.
- DeviceIoControl calls using IOCTL 0x8011E044 originating from non-PassMark processes.
- Sudden token privilege changes on a process followed by SYSTEM-level activity from a previously low-privileged user.
Detection Strategies
- Monitor kernel driver load events (Windows Event ID 6 from Sysmon) for DirectIo64.sys on hosts where PassMark tools are not authorized.
- Hunt for process handles to \\.\DirectIo64 opened by unsigned or unexpected binaries.
- Correlate DeviceIoControl telemetry with subsequent privilege escalation behavior such as new SYSTEM-context child processes.
Monitoring Recommendations
- Maintain an inventory of hosts running PassMark BurnInTest, OSForensics, and PerformanceTest and prioritize them for patching.
- Alert on any user-mode process that loads or interacts with vulnerable BYOVD-class drivers, including DirectIo64.sys.
- Forward driver-load and process-creation events to a centralized analytics pipeline for retroactive hunting.
How to Mitigate CVE-2025-52347
Immediate Actions Required
- Upgrade PassMark BurnInTest, OSForensics, and PerformanceTest to versions later than the affected builds. Refer to the PassMark BurnInTest History, PassMark PerformanceTest History, and OSForensics Updates pages for fixed releases.
- Remove or uninstall PassMark utilities from systems where they are not actively required.
- Add DirectIo64.sys to the Microsoft Vulnerable Driver Blocklist where the driver is not needed for business operations.
Patch Information
Vendor history pages indicate that PassMark addresses driver issues in subsequent builds of BurnInTest, OSForensics, and PerformanceTest. Administrators should consult the linked vendor history pages and deploy the latest fixed builds across all affected endpoints. No formal vendor advisory URL is published in the NVD entry beyond the product history pages.
Workarounds
- Restrict execution of PassMark binaries to administrators only, reducing the population of users who can load the vulnerable driver.
- Enable Windows Hypervisor-Protected Code Integrity (HVCI) and the Microsoft Vulnerable Driver Blocklist to block known-vulnerable signed drivers from loading.
- Apply application control policies (WDAC or AppLocker) to prevent unauthorized loading of DirectIo64.sys.
# Enable the Microsoft Vulnerable Driver Blocklist via registry on Windows
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f
# Verify HVCI / Memory Integrity status
PowerShell -Command "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
