Wednesday, May 5th 2021
Hundreds of Millions of Dell Laptops and Desktops Vulnerable to Privilege Escalation Attacks
Dell notebooks and desktops dating all the way back since 2009—hundreds of millions of them the PC giant has shipped since—are vulnerable to unauthorized privilege escalation attacks, due to a faulty OEM driver the company uses to update the computer's BIOS or UEFI firmware, according to findings by cybersecurity researchers at SentinelLabs. "DBUtil," a driver that Dell machines load during automated or unattended BIOS/UEFI update processes initiated by the user from within the OS, is found to have vulnerabilities that malware can exploit to "escalate privileges from a non-administrator user to kernel mode privileges."
SentinelLabs chronicled its findings in CVE-2021-21551, which details five individual flaws. Two of these point out flaws that can escalate user privileges through controlled memory corruption, two with lack of input validation; and one with denial of service. Organizations that have remote updates enabled for their client machines are at risk, since the flaw can be exploited over network. "An attacker with access to an organization's network may also gain access to execute code on unpatched Dell systems and use this vulnerability to gain local elevation of privilege. Attackers can then leverage other techniques to pivot to the broader network, like lateral movement," writes SentielLabs in its paper.
The good news here, is that SentinelLabs has been working with Dell before going public, and a patched DBUtil driver is ready. The company now stares at the daunting task of pushing patched drivers to potentially hundreds of millions of client PCs it shipped since 2009. The company put out a security advisory that describes CVE-2021-21551 to its end-users, and recommends the next course of action.
A video presentation by SentinelLabs follows.
Source:
BleepingComputer
SentinelLabs chronicled its findings in CVE-2021-21551, which details five individual flaws. Two of these point out flaws that can escalate user privileges through controlled memory corruption, two with lack of input validation; and one with denial of service. Organizations that have remote updates enabled for their client machines are at risk, since the flaw can be exploited over network. "An attacker with access to an organization's network may also gain access to execute code on unpatched Dell systems and use this vulnerability to gain local elevation of privilege. Attackers can then leverage other techniques to pivot to the broader network, like lateral movement," writes SentielLabs in its paper.
A video presentation by SentinelLabs follows.
15 Comments on Hundreds of Millions of Dell Laptops and Desktops Vulnerable to Privilege Escalation Attacks
NOW we know why their infamous commercial elicited so many chuckles the world over.......
I mean it only took 'em 12 friggin years to disclose the flaw, makes me wonder how long they've actually known about them....
People, let's quit making drama where there is none.
I can understand that it might have been missed, but...and IF... lets assume it WAS known, but rose as such a minor issue at that time that it didnt even make it on the list of 'will it ever become an issue'. so never got fixed and forgotten about. Thats a likely scenario given the progress made since that time. Tools and code are looked at differently now, it took years to find the flaw. I still question whether Dell knew or not, if so, it brings up other questions. Deny all you want, but tin hat owners will still ask questions.
Dell is a company that has historically been a top performer when security concerns are a focus. They have nothing to gain by dodging something like this and a lot to loose...
arstechnica.com/gadgets/2021/05/dell-patches-a-12-year-old-privilege-escalation-vulnerability/That is an interesting thing at least.
www.dell.com/support/home/drivers/driversdetails?driverid=7PR57