Ancient update driver endangers hundreds of millions of Dell computers

A vulnerable driver for firmware updates that has shipped with hundreds of millions of Dell desktops, laptops, notebooks and tablets could be abused by attackers to gain kernel-mode privileges for code and should be patched urgently.

SentinelOne researcher Kasif Dekel analysed the dbutil_2_3.sys driver for Windows which has shipped with Dell machines since 2009, and discovered five different flaws.

Four of them allow local privilege escalation through memory corruption and no input validation.

A fifth code logic problem in the driver could be used for denial of service attacks.

"The high severity flaws could allow any user on the computer, even without privileges, to escalate their privileges and run code in kernel mode," the researcher wrote.

"Among the obvious abuses of such vulnerabilities are that they could be used to bypass security products."

The bugs are tracked jointly with the Common Vulnerabilities and Exposures identifier CVE-2021-21551.

They are rated as an 8.8 out of 10 on the Common Vulnerabilities Scoring System version 3.

Dell has acknowledged the problem, which Dekel reported to the vendor on December 1 2020.

Working with Microsoft, Dell issued a new version in May this year that takes care of the vulnerability in the firmware updating package.

However, SentinelOne cautioned that the digital certificate for the older driver is yet to be revoked, which isn't best practice as the vulnerable version can be used in attacks.