BIOS PrivEsc Bugs Affect Hundreds of Millions of Dell PCs Worldwide
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21551 | Local Privilege Escalation in Dell dbutil_2_3.sys Driver CVE-2021-21551 is an insufficient access control flaw (CWE-782) in Dell's dbutil_2_3.sys driver, present on Dell systems for roughly 12 years before being patched. A local, authenticated user can trigger the flaw by sending crafted requests (IOCTLs) to the driver, gaining the ability to read and write arbitrary memory. An attacker who exploits it can escalate privileges (typically to kernel/SYSTEM level), cause a denial of service, or disclose information, making it a useful stepping stone for post-compromise attacks. Any Dell machine that shipped or ran the dbutil driver — used in Dell support and BIOS/BIOS-update tooling — is affected, and public reporting indicates hundreds of millions of Dell PCs are exposed. The flaw is actively exploited: it is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-03-31), public PoCs exist, and the Lazarus APT reportedly used it in attacks to deploy a rootkit; EPSS puts the 30-day exploitation probability at 79.2%. Do: Apply Dell's updated driver/firmware per vendor instructions, as required by CISA's KEV catalog. Inventory your fleet for the dbutil_2_3.sys driver file (commonly found with Dell support tools and BIOS update utilities) and prioritize patching endpoints, since the bug requires only local user access. Hunt for signs of local privilege-escalation activity consistent with public PoCs, given documented Lazarus APT use to deploy a rootkit. | 7.8 | 79% | KEV PoC ×2 |
| masshundreds of millions of Dell PCs (the driver was broadly distributed with Dell support/update tooling for over a decade) |
Full article418 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 05, 2021
PC maker Dell has issued an update to fix multiple critical privilege escalation vulnerabilities that went undetected since 2009, potentially allowing attackers to gain kernel-mode privileges and cause a denial-of-service condition.
The issues, reported to Dell by researchers from SentinelOne on Dec. 1, 2020, reside in a firmware update driver named "dbutil_2_3.sys" that comes pre-installed on its devices. Hundreds of millions of desktops, laptops, notebooks, and tablets manufactured by the company are said to be vulnerable.
"Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service, or information disclosure. Local authenticated user access is required," Dell said in an advisory.
All five separate flaws have been assigned the CVE identifier CVE-2021-21551 with a CVSS score of 8.8. A breakdown of the shortcomings is as follows -
- CVE-2021-21551: Local Elevation Of Privileges #1 – Memory corruption
- CVE-2021-21551: Local Elevation Of Privileges #2 – Memory corruption
- CVE-2021-21551: Local Elevation Of Privileges #3 – Lack of input validation
- CVE-2021-21551: Local Elevation Of Privileges #4 – Lack of input validation
- CVE-2021-21551: Denial Of Service – Code logic issue
"The high severity flaws could allow any user on the computer, even without privileges, to escalate their privileges and run code in kernel mode," SentinelOne Senior Security Researcher Kasif Dekel noted in a Tuesday analysis. "Among the obvious abuses of such vulnerabilities are that they could be used to bypass security products."
Since these are local privilege escalation bugs, they are unlikely to be exploited remotely over the internet. To carry out an attack, an adversary will need to have gained access to a non-administrator account on a vulnerable system, following which the driver vulnerability can be abused to gain local elevation of privilege. Armed with this access, the attacker can then leverage other techniques to execute arbitrary code and laterally move across an organization's network.
Although no evidence of in-the-wild abuse has been detected, SentinelOne said it plans to release the proof-of-concept (PoC) code on June 1, 2021, giving Dell customers ample time to remediate the vulnerability.
SentinelOne's disclosure is the third time the same issue has been reported to Dell over the last two years, according to Crowdtrike's Chief Architect Alex Ionescu, first by the Sunnyvale-based cybersecurity firm in 2019 and again by IOActive. Dell also credited Scott Noone of OSR Open Systems Resources with reporting the vulnerability.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/05/bios-privesc-bug-affects-hundreds-of.html