7.8 CVE-2021-21551
Exploit CISA Kev Catalog
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
https://nvd.nist.gov/vuln/detail/CVE-2021-21551
Categories
CWE-782 : Exposed IOCTL with Insufficient Access Control
The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL. In Windows environments, use proper access control for the associated device or device namespace. See References. Operating system does not enforce permissions on an IOCTL that can be used to modify network settings. Device driver does not restrict ioctl calls to its direct rendering manager. ioctl does not check for a required capability before processing certain requests. Chain: insecure device permissions allows access to an IOCTL, allowing arbitrary memory to be overwritten. Chain: anti-virus product uses weak permissions for a device, leading to resultant buffer overflow in an exposed IOCTL. Chain: sandbox allows opening of a TTY device, enabling shell commands through an exposed ioctl. Anti-virus product uses insecure security descriptor for a device driver, allowing access to a privileged IOCTL. Unauthorized user can disable keyboard or mouse by directly invoking a privileged IOCTL.
References
MISC Exploit
| https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability Mitigation Vendor Advisory |
| http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.html Exploit Third Party Advisory VDB Entry |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:dell:dbutil_2_3.sys:-:*:*:*:*:*:*:* | ||
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| 49893 | DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE) | 2021-05-21 00:00:00 |
Other (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
MITRE
Sherlock® flash
Take a picture of your computer network in a few clicks !
The Sherlock® flash audit solution allows you to perform an audit to strengthen the security of your IT assets. Vulnerability analysis of your physical and virtual equipment. Patch planning by priority level and time available. Detailed and intuitive reporting.
