Hundreds of millions Of Dell PCs affected by CVE-2021
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21551 | Local Privilege Escalation in Dell dbutil_2_3.sys Driver CVE-2021-21551 is an insufficient access control flaw (CWE-782) in Dell's dbutil_2_3.sys driver, present on Dell systems for roughly 12 years before being patched. A local, authenticated user can trigger the flaw by sending crafted requests (IOCTLs) to the driver, gaining the ability to read and write arbitrary memory. An attacker who exploits it can escalate privileges (typically to kernel/SYSTEM level), cause a denial of service, or disclose information, making it a useful stepping stone for post-compromise attacks. Any Dell machine that shipped or ran the dbutil driver — used in Dell support and BIOS/BIOS-update tooling — is affected, and public reporting indicates hundreds of millions of Dell PCs are exposed. The flaw is actively exploited: it is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-03-31), public PoCs exist, and the Lazarus APT reportedly used it in attacks to deploy a rootkit; EPSS puts the 30-day exploitation probability at 79.2%. Do: Apply Dell's updated driver/firmware per vendor instructions, as required by CISA's KEV catalog. Inventory your fleet for the dbutil_2_3.sys driver file (commonly found with Dell support tools and BIOS update utilities) and prioritize patching endpoints, since the bug requires only local user access. Hunt for signs of local privilege-escalation activity consistent with public PoCs, given documented Lazarus APT use to deploy a rootkit. | 7.8 | 79% | KEV PoC ×2 |
| masshundreds of millions of Dell PCs (the driver was broadly distributed with Dell support/update tooling for over a decade) |
Full article375 words · extracted from securityaffairs.com · click to collapse
American multinational computer technology giant Dell addresses a 12-year-old driver flaw, tracked as CVE-2021-21551, impacting millions of computers.
Hundreds of millions of Dell computers worldwide are affected by a 12-year-old vulnerability, tracked as CVE-2021-21551, that affects Dell DBUtil driver. The flaw affects version 2.3 of the Dell BIOS driver, it is one of a series of escalate privileges issues discovered by researchers from SentinelLabs.
The vulnerabilities could be exploited by attackers to access driver functions and execute malicious code with kernel-mode privileges.
An attacker who gained a foothold in the target system could exploit this bug to escalate privilege and take over it, then perform lateral movement within the target network
“These multiple high severity vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges. Over the years, Dell has released BIOS update utilities which contain the vulnerable driver for hundreds of millions of computers (including desktops, laptops, notebooks, and tablets) worldwide.” reads the analysis published by SentinelOne.
Below the list of vulnerabilities reported by the experts:
- CVE-2021-21551: Local Elevation Of Privileges #1 – Memory corruption
- CVE-2021-21551: Local Elevation Of Privileges #2 – Memory corruption
- CVE-2021-21551: Local Elevation Of Privileges #3 – Lack of input validation
- CVE-2021-21551: Local Elevation Of Privileges #4 – Lack of input validation
- CVE-2021-21551: Denial Of Service – Code logic issue
“The high severity flaws could allow any user on the computer, even without privileges, to escalate their privileges and run code in kernel mode. Among the obvious abuses of such vulnerabilities are that they could be used to bypass security products.” continues SentinelLabs.
“An attacker with access to an organization’s network may also gain access to execute code on unpatched Dell systems and use this vulnerability to gain local elevation of privilege.”
The vulnerabilities were initially reported to Dell in December 2020 which addressed the flaws.
Administrators should install the Dell DBUtil updates as soon as possible.
The experts also published a video PoC to demonstrate the first LPE due to memory corruption.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Dell DBUtil)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/117514/security/cve-2021-21551-dell-flaws.html