CVE-2020-15480: 
PassMark PerformanceTest vulnerability analysis and mitigation

An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The kernel driver (DirectIo32.sys and DirectIo64.sys) exposes IOCTL functionality that allows low-privilege users to read and write to arbitrary Model Specific Registers (MSRs). This vulnerability was discovered in June 2020 and publicly disclosed in August 2020 (ESET Disclosure).

The vulnerability exists in the driver's IOCTL handler which exposes rdmsr and wrmsr functionality through two specific IOCTLs: IOCTL_READ_MSR (0x80112060) and IOCTL_WRITE_MSR (0x80112088). This allows unprivileged users to manipulate critical MSRs like IA32_LSTAR (0xC0000082) or IA32_SYSENTER_EIP (0x00000176). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to achieve arbitrary Ring-0 code execution and escalation of privileges. This is particularly severe as it can be exploited even on modern Windows 10 systems despite existing kernel exploit mitigation techniques (ESET Disclosure).

The exploitability is rated as Medium/Low since the driver must be loaded prior to exploitation to be utilized by low-privilege users. If the driver is not already loaded, the attacker would require administrative rights for driver installation. The vulnerability has been observed being exploited in the wild by APT groups and in commodity malware (WeLiveSecurity).

The vulnerability was fixed in the August 2020 updates of the vendor's products. Users should update to versions newer than BurnInTest 9.1, OSForensics 7.1, and PerformanceTest 10 to receive the patched version of the driver (ESET Disclosure).