CVE-2022-29092
📋 TL;DR
Dell SupportAssist contains a privilege escalation vulnerability where non-admin users can gain admin access to the system. This affects both Consumer and Commercial versions of the software on Windows systems. Attackers with local access can exploit this to elevate privileges.
💻 Affected Systems
- Dell SupportAssist Client Consumer
- Dell SupportAssist Client Commercial
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing installation of malware, data theft, persistence mechanisms, and lateral movement across the network.
Likely Case
Local privilege escalation leading to administrative control over the affected system, enabling further malicious activities.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though privilege escalation remains possible.
🎯 Exploit Status
Requires local access but exploitation is straightforward once access is obtained. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Consumer version 3.11.1 or later, Commercial version 3.2.1 or later
Restart Required: Yes
Instructions:
1. Open Dell SupportAssist. 2. Check for updates in settings. 3. Install available updates. 4. Restart the system. Alternatively, download latest version from Dell's website.
🔧 Temporary Workarounds
Uninstall SupportAssist
windowsRemove vulnerable software entirely if not needed
Control Panel > Programs > Uninstall a program > Select Dell SupportAssist > Uninstall
Restrict Local Access
allLimit physical and remote access to vulnerable systems
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to affected systems
- Monitor for privilege escalation attempts and unusual administrative activity
🔍 How to Verify
Check if Vulnerable:
Check SupportAssist version: Open SupportAssist > Settings > About. Compare version against affected ranges.Check Version:
wmic product where name="Dell SupportAssist" get versionVerify Fix Applied:
Verify version is Consumer 3.11.1+ or Commercial 3.2.1+. Test with non-admin account attempting privilege escalation.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- SupportAssist process spawning with elevated privileges
- Failed or successful UAC bypass attempts
Network Indicators:
- Unusual outbound connections from SupportAssist processes
SIEM Query:
EventID=4688 AND ProcessName="*SupportAssist*" AND NewProcessName="*cmd*" OR NewProcessName="*powershell*"🔗 References
- https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
- https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
