Dells bells on horseback!

Topic

New Reply

[Microfix]

Using a Dell device? you may want to read this article:
Vulnerable Dell driver puts hundreds of millions of systems at risk

Five flaws in one
A collection of five flaws, collectively tracked as CVE-2021-21551, have been discovered in DBUtil, a driver from that Dell machines install and load during the BIOS update process and is unloaded at the next reboot.

and from the horses mouth

and keep an eye on your dell updates..

If debian is good enough for NASA...

• This topic was modified 3 years, 10 months ago by Microfix.

6 users thanked author for this post.

jburk07, lmacri, Kirsty, RockE, EricB, Alex5723

Reply | Quote

Replies

This type of vulnerability is not considered critical because an attacker exploiting it needs to have compromised the computer beforehand

If your system is already secure from external threats you need not worry.
Wait until Dell release an updated driver.

cheers, Paul

1 user thanked author for this post.

jburk07

Reply | Quote

Dell has a fix :

Summary: Dell released an update utility to mitigate a security vulnerability affecting the dbutil_2_3.sys driver packaged with Dell Client firmware update utility packages and tools.

“Remediation Steps:

Impacted customers must complete 2 steps as follows:
Immediately remove the vulnerable dbutil_2_3.sys driver from the affected system using one of the following options from Step 1 below: download and run a utility to remove the driver from the system (Option 1), manually remove the driver from the system (Option 2), or on or after May 10, 2021, utilize one of the Dell notification solutions to run the utility (Option 3).
As described in Step 2 below, obtain and run the latest firmware update utility package(s), Dell Command Update, Dell Update, Alienware Update, Dell System Inventory Agent, or Dell Platform Tags as applicable….

Reply | Quote

And before freaking out users should review Dell’s advisory to see if their own system is or is not affected by the issue.

2 users thanked author for this post.

jburk07, Kirsty

Reply | Quote

The fix was seen in the link that Microfix posted in the original topic post, above.

Reply | Quote

Hi Microfix:

Thanks for the heads up.

I have a Dell Inspiron 15 5584 with the latest 5583/5584 BIOS v1.12.0 (installed 01-Feb-2021), which is listed as an affected system in Table A of DSA-2021-088: Dell Client Platform Security Update for an Insufficient Access Control Vulnerability in the Dell dbutil Driver, but I can’t find this dbutil_2_3.sys file in either C:\Windows\Temp or the hidden C:\Users\<myusername>\AppData\Local\Temp.  I don’t know if that’s because this driver file was never created on my system or if it was removed when I recently cleaned all my temp folders with CCleaner (which clears both those temp folders).
———-
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v20H2 build 19042.928 * Dell BIOS v1.12.0 * Dell SupportAssist v3.8.1.23 * Dell Update v4.1.0 * CCleaner Free Portable 5.79.8704

Reply | Quote

I have a Latitude E5470 that is impacted. Dell’s update instructions make my head spin a bit! I can run this utility, but like Imacri, I don’t see the dbutil file in the Temp folder.  Should I run this anyway?

Step 1: Immediately remove the vulnerable dbutil_2_3.sys driver from the affected system using one of the options below. NOTE: If you are using the Dell System Inventory Agent you must first download the latest available version (2.6.0.0 or greater) here.

Option 1 (Recommended): Download and run the Dell Security Advisory Update – DSA-2021-088 utility.

I did see a BIOS update on 4/28/21 – I will install that, I assume it’s updated for this vulnerability.

And finally, had I not clicked on CODE RED I wouldn’t have known about this – Dell really should be more proactive in notifying customers of vulnerabilities.

 

Reply | Quote

Also in the same boat here, both folders checked and nothing found.

I wonder if being logged in to the Admin account instead of Standard would make any difference?

Reply | Quote

I don’t think it matters.  An exploit is not likely if by chance the dbutil is there and the remediation will fix the issue.

From Dell website:

Q: Could a malicious actor exploit this vulnerability?

A: A malicious actor would first need to be granted access to your PC, for example through phishing, malware or by you granting remote access. To help protect yourself from malicious actors, never agree to give remote control to your computer to any unsolicited contact (such as from an email or phone call) to fix an issue.
Dell is not aware of this vulnerability having been exploited by a malicious actor to date.

Q: Why are there 2 steps in the “Remediation” section of Dell Security Advisory DSA-2021-088
A: Step 1 is to immediately remediate this vulnerability. Step 2 is focused on informing you how to install a remediated dbutil driver during your next scheduled firmware update. For each step, Dell is offering different options, and you should choose the option that best matches your circumstances.

Step 2: To prevent reintroduction of a vulnerable dbutil driver, obtain and run a remediated firmware update utility package, Dell Command Update, Dell Update, Alienware Update, Dell System Inventory Agent, or Dell Platform Tags as applicable.

Now, I ran the BIOS update today but it didn’t work! I don’t know what happened, I ran the BIOS exe, my laptop booted and came up very quickly, too quickly to complete a Bios update and when I checked, it was the old BIOS.  Computer is working.  I’ll try again.

Reply | Quote

I just realized I didn’t actually type out all my reply.

In regards to being signed in to the Admin account verse the Standard User account, I was thinking in terms of needing to be signed in as Admin to see that accounts temp files.

But after seeing the post below by @Mele20 I don’t think I need to worry since I’ve never touched the BIOS on this system.

Reply | Quote

I have a Dell Inspiron 15 5593 laptop which is on the list of affected systems in Table A.

When I ran the Dell utility recommended in Step 1 Option 1 it reported that the dbutil 2.3 driver was not found on my laptop.

So just because your Dell PC is listed in Table A it doesn’t always mean that your system has the dodgy driver (also see Imacri’s post above).

2 users thanked author for this post.

dmt_3904, jburk07

Reply | Quote

Hey Y’all,

Here’s a little PS utility that will do the work for you.

Function Remove-ProblemFile {

  Param (
    [Parameter(Mandatory=$True)]
    [AllowNull()]
    [Object] $BadFile
  )

  If ($Null -ne $BadFile) {
    Try {
           Remove-Item -Path $($BadFile.FullName) -Force
           "$($BadFile.FullName) removed successfully"
           $Script:FileCnt += 1
    }
    Catch {
           "$($BadFile.FullName) removal unsuccessful"
    }
  }

} #End Function Remove_ProblemFile

Clear-Host

$FName   = "dbutil_2_3.sys"
$FileCnt = 0

$GCIArgs = @{Path = "C:\Users\$($env:USERNAME)\AppData\Local\Temp"
             File = $True
             Filter = $FName}

Remove-ProblemFile -BadFile (Get-ChildItem @GCIArgs)

$GCIArgs.Path = "C:\Windows\Temp"

Remove-ProblemFile -BadFile (Get-ChildItem @GCIArgs)

"$FileCnt file(s) removed."

HTH 😎

May the Forces of good computing be with you!

RG

PowerShell & VBA Rule!
Computer Specs

Reply | Quote

My Dell XPS 8930 (3.5 years old) is NOT affected because I don’t have that driver because I never update BIOS unless absolutely necessary and, generally, it is NOT necessary during the life of a computer.

A lot of home users do not have a UPS and, unless you do, should NEVER update BIOS. It’s way too risky without any power supply backup if needed.

My Dell is on the list but I won’t be flashing the BIOS (even though my Dell is connected to my UPS).

1 user thanked author for this post.

Moonbear

Reply | Quote

Hi Microfix:

Dell SupportAssist v3.9.0 delivered an update today (08-May-2021) for “Dell Security Advisory Update – DSA-2021-088” so I assume I’m patched now for the DBUtil driver vulnerability described in DSA-2021-088: Dell Client Platform Security Update for an Insufficient Access Control Vulnerability in the Dell dbutil Driver.
———-
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v20H2 build 19042.928 * Dell BIOS v1.12.0 * Dell SupportAssist v3.9.0.234 * Dell Update v4.1.0

Reply | Quote

Another heads up folks: 24th June 2021
Dell SupportAssist bugs put over 30 million PCs at risk!
Have ‘SupportAssist’ on your Dell and use/have used BIOSConnect?

The issue affects 129 Dell models of consumer and business laptops, desktops, and tablets, including devices protected by Secure Boot and Dell Secured-core PCs

You had better read this article on Bleeping Computer

If debian is good enough for NASA...

2 users thanked author for this post.

WCHS, lmacri

Reply | Quote

I updated my bios recently.  I downloaded bios and installed it. Does this mean my systems not affected?  I don’t think I’ve ever used support assist.

Reply | Quote

Hi dmt_3904:

A list of affected computer models and the minimum BIOS version that will patch these vulnerabilities is listed in the table under “Additional Information” section of Dell Security Advisory DSA-2021-106: Dell Client Platform Security Update for Multiple Vulnerabilities in the BIOSConnect and HTTPS Boot Features as Part of the Dell Client BIOS.  According to that security advisory:

…CVE-2021-21573 and CVE-2021-21574 were remediated on the server side on May 28, 2021 and require no additional customer action.

CVE-2021-21571 and CVE-2021-21572 require Dell Client BIOS updates to address the vulnerabilities. See the table under the Additional Information section to determine the version of the remediated Dell Client BIOS to apply to your system. There are multiple ways to update your Dell Client BIOS. If you typically use BIOSConnect to update your BIOS, Dell recommends using a different method to apply the BIOS updates…

My Inspiron 5584 does not appear to be one of the affected models.
———-
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v20H2 build 19042.1052 * Dell 5583/5584 BIOS v1.13.0 * Dell SupportAssist v3.9.1.245 * Dell Update v4.2.1

3 users thanked author for this post.

Nibbled To Death By Ducks, Microfix, dmt_3904

Reply | Quote

It looks like my latitude E5470 is not impacted. Thanks.  Donna

Reply | Quote

If one is using SupportAssist to do BIOS updates, is one therefore using BIOSConnect by implication??

Reply | Quote

Looks like Dell and Eclypsium are equally unperturbed:

“To exploit the vulnerability chain in BIOSConnect, a malicious actor must separately perform additional steps before a successful exploit, including: compromise a user’s network, obtain a certificate that is trusted by one of the Dell UEFI BIOS https stack’s built-in Certificate Authorities, and wait for a user who is physically present at the system to use the BIOSConnect feature,” sniffed an unimpressed Dell.

Eclypsium agreed, saying: “An attack scenario would require an attacker to be able to redirect the victim’s traffic, such as via a Machine-in-the-Middle (MITM) attack.”

If you don’t fancy upgrading SecureAssist, an effective mitigation is simply to delete the utility, according to Dell.

https://www.theregister.com/2021/06/25/dell_secureassist_biosconnect_vulns_rce/

—

Seems like “Cold Kale het agin’. “

Win7 Pro SP1 64-bit, Dell Latitude E6330, Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Greenhorn
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty

Reply | Quote

Hi Nibbled To Death By Ducks:

You skipped the second-last paragraph of that article <here> on The Register that states:

Bharat Jogi, Qualys senior manager of vulnerability and threat research, commented: “The four vulnerabilities on Dell devices are highly concerning. BIOS is critical for a device boot process and its security is vital to ensure safety of the entire device. This is especially important in the current environment due to the increased wave of supply chain attacks. This chain of security vulnerabilities allow for bypass of Secure Boot protections, can be exploited to take complete control of the device and hence organisations should prioritise patching.”

Andy Greenberg’s 31-May-2021 Hacker Lexicon: What Is a Supply Chain Attack? on wired.com describes a supply chain attack as “a technique in which an adversary slips malicious code or even a malicious component into a trusted piece of software or hardware“. One of the examples used in that article is the huge SolarWind hack in 2020 that allowed illegal access to “at least nine US federal agencies, including NASA, the State Department, the Department of Defense, and the Department of Justice“. Dell has given the vulnerabilities in security advisory DSA-2021-106 a High impact rating and CVSS Base Score of 7.2 so I think there’s a legitimate cause for concern, especially if vulnerable, unpatched machines are being used in a business environment.
———–
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v20H2 build 19042.1052 * Dell 5583/5584 BIOS v1.13.0 * Dell SupportAssist v3.9.1.245

Reply | Quote

Just a heads up that I ran a check for updates today with Dell Update v4.3.0 and I’m being offered a new DBUtil Removal Utility v2.5.0 (rel. 03-Aug-2021). I originally thought I was being re-offered the DBUtil Removal Tool v1.x I ran in May 2021 for DSA-2021-088 but it looks like there’s been a new bug found  in the DBUtilDrv2.sys driver.  See the DSA-2021-152: Dell Client Platform Security Update for an Insufficient Access Control Vulnerability in the Dell DBUtilDrv2.sys Driver (last revised 06-Aug-2021; my Inspiron 5584 is listed in Table 1 as an affected product) as well as the “Additional Information” FAQ <here> that has more information about the vulnerability in versions 2.5 and 2.6 of the DBUtilDrv2.sys driver (CVE-2021-36276).

The attached images are from the support page <here>  for my Inspiron 5584 and my Dell Update v4.3.0 update check of 08-Aug-2021.

—–———
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v20H2 build 19042.1110 * Dell 5583/5584 BIOS v1.14.1 * Dell SupportAssist v3.10.1.23 * Dell Update for Windows 10 v4.3.0

3 users thanked author for this post.

stewagreen, WCHS, DrBonzo

Reply | Quote