To exploit the vulnerability, threat actors will already need administrator privileges, which may make it silly to be concerned about this vulnerability.

The write-what-where condition persists in dbutildrv2.sys 2.5 and 2.7, so attackers have a total of three signed driver candidates for kernel code execution. The Dell problemĭell's 'dbutil_2_3.sys' driver, which is the driver that is vulnerable to CVE-2021-21551, can facilitate BYOVD attacks, and as Rapid7 researchers warn, this applies to recent driver versions too. There are at least four open-source exploits enabling actors to load unsigned drivers onto the Windows kernel, and one of them, KDU, supports over 14 driver options.īased on that alone, and without even accounting for custom tools authored by sophisticated actors and used privately and exclusively, it becomes clear that BYOVD is a permanent threat. Unfortunately, even though Microsoft has attempted to mitigate the issue with stricter Windows DSE (Driver Signature Enforcement) rules, the problem persists. It is a known technique that has been widely deployed in the wild for many years. This vulnerable driver is then exploited to elevate privileges or execute code on the target system. 'However, the partially fixed driver can still help attackers.' What’s BYOVDīYOVD is the abbreviation for ' Bring Your Own Vulnerable Driver,' an attack technique in which threat actors install a legitimate but vulnerable driver on a target machine. According to Microsoft's definition of security boundaries, Dell's fix removed the security issue,' explains Rapid7 researcher Jake Baines. 'We found that Dell's update didn't fix the write-what-where condition but only limited access to administrative users. However, Dell's fix wasn't comprehensive enough to prevent additional exploitation, and as security researchers warn now, it is an excellent candidate for future Bring Your Own Vulnerable Driver (BYOVD) attacks.

In May 2021, a set of five vulnerabilities in Dell computer drivers collectively tracked as CVE-2021-21551 was disclosed and fixed after it remained exploitable for 12 years.

Win 7 creator utility dell