← Back to driver explorer
Driver intelligenceVulnerableVerified
DBUtilDrv2.sys
Dell DBUtilDrv2.sys versions 2.5, 2.6, and 2.7 all contain a write-what-where condition allowing kernel memory read/write. Dell released v2.7 as a remediation for CVE-2021-36276 but the fix was incomplete. Rapid7 confirmed v2.7 retains the kernel memory primitive and published the dellicious PoC and a Metasploit module (post/windows/manage/dell_memory_protect) that works against both v2.5 and v2.7. Dell categorized the v2.7 issue as a weakness rather than a vulnerability, stating it requires admin privileges.
Known samples 2
2 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
DBUtilDrv2.sysSample 1 · HVCI TRUE
- MD5
dacb62578b3ea191ea37486d15f4f83c- SHA1
90a76945fd2fa45fab2b7bcfdaf6563595f94891- SHA256
2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8- Imphash
f138fdbc6c7fbf73e135717c7d7eac27- Authentihash MD5
3736439958e5533142648f0d278fe7df- Authentihash SHA1
6bc2ab0f03d7a58685a165b519e8fee6937526a6- Authentihash SHA256
d7c683ef033ac2dc4dfa0dc61f39931f91c0e8fd19e613f664cb03e14112ef6e- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
DBUtilDrv2.sysSample 2 · HVCI TRUE
- MD5
d104621c93213942b7b43d65b5d8d33e- SHA1
b03b1996a40bfea72e4584b82f6b845c503a9748- SHA256
71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009- Imphash
506a31d768aec26b297c45b50026c820- Authentihash MD5
1e96108c0938d4c34d7072f04bc8b951- Authentihash SHA1
d46ae9bcc746ca408fbb55fb0d61b638720a8f25- Authentihash SHA256
7bacb353363cc29f7f3815a9d01e85cd86202d92378d1ab1b11df1ab2f42f40a- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Dell
Recorded command
sc.exe create DBUtilDrv2.sys binPath=C:\windows\temp\DBUtilDrv2.sys type=kernel && sc.exe start DBUtilDrv2.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/jbaines-r7/dellicious
- https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
- https://www.bleepingcomputer.com/news/security/dell-driver-fix-still-allows-windows-kernel-level-attacks/
- https://www.rapid7.com/db/modules/post/windows/manage/dell_memory_protect/