CVE-2021-21551
Dell dbutil Driver Insufficient Access Control Vulnerability
Description
CVE-2021-21551 is an insufficient access control vulnerability in Dell's dbutil_2_3.sys driver that allows a locally authenticated attacker to escalate privileges to kernel level. The vulnerable driver is installed on Dell systems as part of BIOS update utilities and firmware update packages. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 0.3% (69th percentile), this vulnerability has been used in targeted attacks for privilege escalation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| dell | dbutil | <= 2.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21551(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
Improper access control occurs when an application does not properly restrict access to resources, allowing unauthorized actions. In CVE-2021-21551, the Dell dbutil driver exposes kernel-level functionality to user-mode applications without proper access controls, enabling privilege escalation from standard user to kernel level. For more details, see CWE-284.
Impact Analysis
Successful exploitation of this vulnerability grants kernel-level access on affected Dell systems, the highest privilege level in the Windows operating system. Kernel access allows attackers to bypass all security mechanisms, disable endpoint protection software, access encrypted data, install persistent rootkits, and maintain stealth presence on the compromised system. The vulnerability is particularly impactful because the affected driver is widely deployed across Dell commercial and consumer systems through standard firmware update processes. This means a large number of enterprise workstations and laptops may have the vulnerable driver installed without explicit administrator knowledge.
Exploit Maturity
CVE-2021-21551 was added to CISA's KEV catalog on March 31, 2022, confirming active exploitation. The EPSS score of 0.3% (69th percentile) reflects targeted rather than mass exploitation, which is typical for driver-based privilege escalation vulnerabilities. The Lazarus APT group was reported to have used a malicious driver tool based on CVE-2021-21551 to disable security monitoring software on compromised systems. Public proof-of-concept exploits are available, and the vulnerability has been integrated into post-exploitation toolkits.
Remediation
- Remove the vulnerable dbutil_2_3.sys driver from all Dell systems using the Dell Security Advisory DSA-2021-088 removal utility, as recommended by CISA's KEV catalog.
- Update Dell firmware update utilities (Dell Command Update, Dell Update, Alienware Update) to versions that no longer include the vulnerable driver.
- Implement driver blocklist policies using Windows Defender Application Control (WDAC) or similar tools to prevent the vulnerable driver from loading.
- Audit systems for the presence of dbutil_2_3.sys and related vulnerable drivers across the organization.
- Deploy endpoint detection tools that can identify exploitation attempts targeting vulnerable kernel drivers.
Technical Details
The vulnerability exists in Dell's dbutil_2_3.sys kernel driver, which is installed as part of Dell BIOS update and firmware update utilities. The driver provides direct hardware access functionality intended for firmware operations but exposes this capability to user-mode applications through IOCTL (Input/Output Control) interfaces without adequate access control verification. Specifically, the driver allows user-mode processes to read and write arbitrary physical memory, read and write processor MSR (Model Specific Registers), and perform other privileged operations. An attacker can leverage these capabilities to modify kernel memory, disable security software, and execute arbitrary code at the kernel level. The attack requires only standard user privileges and local access to a system with the vulnerable driver installed.
Frequently Asked Questions
What is CVE-2021-21551?
CVE-2021-21551 is a privilege escalation vulnerability in Dell's dbutil_2_3.sys kernel driver. The driver, installed through Dell BIOS and firmware update utilities, exposes kernel-level capabilities to standard user applications without proper access controls, allowing privilege escalation.
How did this driver get on my system?
The vulnerable driver is typically installed as part of Dell BIOS Update Utility, Dell Command Update, Dell Update, or Alienware Update. It may have been installed through automated firmware updates or manual driver installations on Dell systems.
Is my non-Dell system affected?
The vulnerability specifically affects the Dell dbutil_2_3.sys driver. Non-Dell systems would only be affected if the driver was manually installed, which is unlikely. However, similar driver-based vulnerabilities exist in other vendors' utilities.
Has this been used by APT groups?
Yes, the Lazarus APT group was reported to have used exploitation techniques based on CVE-2021-21551 to create a tool that disables security monitoring software on compromised systems, demonstrating the practical value of driver-based privilege escalation in advanced attack campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.