The cybersecurity researchers have detected a set of five high-severity flaws in hundred of millions of Dell’s firmware update. The set of Five high-severity flaws is affecting Dell computers, laptops, notebooks, and tablets.
The security researchers at SentinelOne’s SentinelLabs declared in their report that Dell has published hundreds of millions of Windows devices throughout the world, and all these devices contain the vulnerable driver.
After the deep investigation, researchers came to know that the firmware update driver comes up as it accepts IOCTL (Input/Output Control) requests without any ACL requirements.
However, the security analysts claimed that it is not good to allow any process to communicate with your driver, the reason is that most probably every driver works with the highest privileges.
The new firmware update has revealed several functions of the flaw, with the help of IRP_MJ_DEVICE_CONTROL. Not only this but it also provides a powerful primitive so that it can easily exploit the bug.
Five Flaws In One
The cybersecurity researchers have detected a set of five high-severity flaws, and it is labeled as CVE-2021-21551. These five flaws have been detected in DBUtil, that’s why after investigating the driver of DBUtil the analysts came to know that it can be exploited “to generate all the privileges from a non-administrator user to kernel mode privileges.”
This vulnerability is not that critical, because in this type of vulnerability the threat actor exploits according to its needs so that they can easily compromise the computer in advance.
The set of five flaws is being listed below:-
- CVE-2021-21551: Local Elevation Of Privileges (Memory corruption)
- CVE-2021-21551: Local Elevation Of Privileges (Memory corruption)
- CVE-2021-21551: Local Elevation Of Privileges (Lack of input validation)
- CVE-2021-21551: Local Elevation Of Privileges (Lack of input validation)
- CVE-2021-21551: Denial of Service (Code logic issue)
Consequence
These critical flaws can easily compromise the computers, whether they had privileges or not, and to gain the privileges the threat actors can easily run code in kernel mode.
Once the attacker exploits the computer, it generally gains access to the organization, after that, they easily execute code on the unpatched Dell systems and later use this vulnerability to obtain the local elevation of privilege.
Mitigation
After knowing all the key details of this vulnerability, the cybersecurity specialists have provided some mitigation to overcome or bypass such vulnerability.
The very initial mitigations for the users are to apply the patches as soon as possible. However, Dell is still trying to provide all the possible patches in their Dell Security Advisory DSA-2021-088.
