Security News > 2021 > May > 'Millions' of Dell PCs will grant malware, rogue users admin-level access if asked nicely

Dell desktops, laptops, and tablets built since 2009 and running Windows can be exploited to grant rogue users and malware system-administrator-level access to the computers.

Essentially, Dell's driver accepts system calls from any user or program on a machine; there are no security checks nor an access control list to see if the caller is sufficiently authorized or privileged.

"Dell has remediated the dbutil driver and has released firmware update utility packages for supported platforms running Windows 10, Dell Command Update, Dell Update, Alienware Update, Dell System Inventory Agent and Dell Platform Tags," the computing behemoth said.

"For supported platforms on Windows when you install a remediated package containing the BIOS, Thunderbolt firmware, TPM firmware, or dock firmware; or update Dell Command Update, Dell Update, or Alienware Update; or install the latest version of Dell System Inventory Agent or Dell Platform Tags.".

The infosec researchers note Dell hasn't rescinded the code-signing certificate for the insecure Windows driver yet.

We've asked Dell if or when this is likely to occur and will update you accordingly.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/05/04/dell_driver_flaw/