Dell dbutil Driver Insufficient Access Control Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-31
• EPSS: 80% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

CISA: Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Apr 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.htmlExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-…ExploitThird Party AdvisoryVDB Entry
• www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-u…MitigationVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource