In May 2021, a group of five vulnerabilities in Dell computer drivers was identified and partially addressed under the general identifier CVE-2021-21551, which had remained exploitable for over 12 years. However, Dell’s update proved insufficient to completely prevent attacks, and these drivers are now a potential target for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Dell’s update restricted administrative user rights, but did not address the critical write-what-where issue that allows attackers to execute arbitrary code in Windows kernel mode. As Rapid7 analyst Jake Baines notes, the update solved the problem from the perspective of Microsoft’s security boundaries, but attackers can still exploit the partially patched driver.
BYOVD is an attack method in which a genuine but vulnerable driver is installed on the target system. With it, attackers gain elevated privileges or execute code in the kernel. Despite Microsoft’s efforts to strengthen driver digital signature enforcement (DSE), the problem remains. There are at least four open source vulnerabilities that allow unsigned drivers to be loaded, including the KDU tool, which provides more than 14 driver options.
In particular, BYOVD attacks can use Dell’s dbutil_2_3.sys driver, which is vulnerable to CVE-2021-21551, which is also relevant for current versions of the driver. The write-what-where vulnerability persists in versions 2.5 and 2.7, providing attackers with three signed drivers to execute code in kernel mode. Administrator privileges are required to exploit it, but experienced attackers can use it to run code with maximum privileges (ring 0), install a UEFI rootkit, cover their tracks, and execute virtually any command in Windows.
Rapid7 researchers even created a Metasploit module that uses drivers 2.5 and 2.7 to bypass LSA protection and control process protection by PID.
“Dell drivers are particularly valuable because they meet Microsoft’s latest digital signature requirements,” the experts note. Since new versions of the drivers are unlikely to be blocked, they remain vulnerable to targeted, covert attacks. At the moment, attackers are limited to using dbutil_2_3.sys, but experts believe it is only a matter of time before versions 2.5 and 2.7 also begin to be used in attacks. Therefore, it is extremely important today to strengthen detection and protection measures.