CVE-2021-21551
Dell Dbutil ≤ 2.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-21551 is a high-severity Exposed IOCTL with Insufficient Access Control (CWE-782) vulnerability in Dell Dbutil. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an insufficient access control flaw, tracked as CVE-2021-21551, in the Dell dbutil_2_3.sys driver. It is assigned CWE-782 and carries a CVSS 3.1 base score of 8.8 with the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The affected component is a kernel-mode driver distributed with multiple Dell client platforms.
A local authenticated user can send specially crafted IOCTL requests to the driver, enabling arbitrary kernel memory read and write operations. Successful exploitation can result in privilege escalation to kernel level, denial of service through system crashes, or disclosure of sensitive kernel memory contents.
Dell’s DSA-2021-088 advisory describes the issue and directs customers to install the updated driver versions provided in the security update package. Public proof-of-concept code demonstrating both memory read/write primitives and privilege-escalation chains has been published on Packet Storm.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-8823
Vulnerability Data
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
- CWE(s)
- KEV Date Added
- 31 March 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V8.2.1
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged access rights directly restrict who may invoke sensitive IOCTLs.
Secure development lifecycle includes design-time access-control requirements for device interfaces.
A.8.26 only requires that security requirements (including access controls) be identified and specified during development; it does not itself enforce, implement or prevent exploitation of an exposed IOCTL
A.8.27 mandates security-by-design, least privilege, default-deny, and explicit access-control analysis in architecture and hardening, which reaches the authorization logic around an IOCTL; it does not guarantee that every driver or third-party component will correctly implement those principles, leaving a bounded remainder.
Secure coding practices prevent omission of access-control checks on IOCTL handlers.
Security testing can detect missing IOCTL authorization during development.