PT-2021-7660 · Dell · Dbutil 2 3.Sys

Alex Ionescu + 5 · Published 2021-05-04 · Updated 2025-04-25 · CVE-2021-21551

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell dbutil 2 3.sys driver (affected versions not specified)

Description The Dell dbutil 2 3.sys driver contains an insufficient access control vulnerability, which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. This issue has been exploited by the Lazarus group in a spy campaign, where they used a technique called Bring Your Own Vulnerable Driver (BYOVD) to install a legitimate but vulnerable driver on the victim's device. The vulnerability was then exploited to read and write kernel memory, allowing the attackers to disable security monitoring and execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-782

CWE-285

Related Identifiers

BDU:2023-01062

CVE-2021-21551

Affected Products

Dbutil 2 3.Sys

References · 82

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb · Exploit
• 🔥 https://github.com/waldo-irc/CVE-2021-21551 · Exploit
• 🔥 https://github.com/tijme/kernel-mii · Exploit
• 🔥 https://github.com/mathisvickie/CVE-2021-21551 · Exploit
• 🔥 https://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551 · Exploit
• 🔥 https://github.com/ch3rn0byl/CVE-2021-21551 · Exploit
• 🔥 https://github.com/nanabingies/CVE-2021-21551 · Exploit
• 🔥 https://github.com/mzakocs/CVE-2021-21551-POC · Exploit
• 🔥 http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.html · Exploit
• 🔥 http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html · Exploit
• 🔥 https://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html · Exploit
• 🔥 https://exploit-db.com/exploits/49893 · Exploit
• https://bdu.fstec.ru/vul/2023-01062 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21551 · Security Note
• https://dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability · Vendor Advisory