Thursday, March 28, 2024

Hundreds of Millions of Dell Systems Vulnerable to Hack Due to Driver Bug

The cybersecurity researchers have detected a set of five high-severity flaws in hundred of millions of Dell’s firmware update. The set of Five high-severity flaws is affecting Dell computers, laptops, notebooks, and tablets.

The security researchers at SentinelOne’s SentinelLabs declared in their report that Dell has published hundreds of millions of Windows devices throughout the world, and all these devices contain the vulnerable driver.

After the deep investigation, researchers came to know that the firmware update driver comes up as it accepts IOCTL (Input/Output Control) requests without any ACL requirements.

However, the security analysts claimed that it is not good to allow any process to communicate with your driver, the reason is that most probably every driver works with the highest privileges.

The new firmware update has revealed several functions of the flaw, with the help of IRP_MJ_DEVICE_CONTROL. Not only this but it also provides a powerful primitive so that it can easily exploit the bug.

Five Flaws In One

The cybersecurity researchers have detected a set of five high-severity flaws, and it is labeled as CVE-2021-21551. These five flaws have been detected in DBUtil, that’s why after investigating the driver of DBUtil the analysts came to know that it can be exploited “to generate all the privileges from a non-administrator user to kernel mode privileges.”

This vulnerability is not that critical, because in this type of vulnerability the threat actor exploits according to its needs so that they can easily compromise the computer in advance. 

The set of five flaws is being listed below:-

  • CVE-2021-21551: Local Elevation Of Privileges (Memory corruption)
  • CVE-2021-21551: Local Elevation Of Privileges (Memory corruption)
  • CVE-2021-21551: Local Elevation Of Privileges (Lack of input validation)
  • CVE-2021-21551: Local Elevation Of Privileges (Lack of input validation)
  • CVE-2021-21551: Denial of Service (Code logic issue)

Consequence

These critical flaws can easily compromise the computers, whether they had privileges or not, and to gain the privileges the threat actors can easily run code in kernel mode.

Once the attacker exploits the computer, it generally gains access to the organization, after that, they easily execute code on the unpatched Dell systems and later use this vulnerability to obtain the local elevation of privilege.

Mitigation 

After knowing all the key details of this vulnerability, the cybersecurity specialists have provided some mitigation to overcome or bypass such vulnerability.

The very initial mitigations for the users are to apply the patches as soon as possible. However, Dell is still trying to provide all the possible patches in their Dell Security Advisory DSA-2021-088.

Moreover, there is not any kind of indication regarding these vulnerabilities is being exploited in the wild. But, both the specialists and Dell is trying their best to overcome this vulnerability.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles