CVE-2022-29092: Dell SupportAssist Privilege Escalation

CVE-2022-29092 Overview

CVE-2022-29092 is a local privilege escalation vulnerability in Dell SupportAssist Client for both Home PCs and Business PCs. The flaw allows a non-administrative user on an affected system to gain administrator-level access. Dell classified the issue under CWE-427: Uncontrolled Search Path Element, which is commonly associated with DLL search order hijacking in Windows applications. Dell disclosed the vulnerability in security advisory DSA-2022-139 and shipped fixed builds for both consumer and commercial product lines.

Critical Impact
A local, low-privileged user can escalate to administrator on any Windows endpoint running vulnerable Dell SupportAssist builds, providing a path to full system compromise.

Affected Products

Dell SupportAssist Client Consumer (Home PCs) version 3.11.0 and prior
Dell SupportAssist Client Commercial (Business PCs) version 3.2.0 and prior
Windows endpoints with the Dell SupportAssist service preinstalled by OEM

Discovery Timeline

2022-06-10 - CVE-2022-29092 published to NVD alongside Dell advisory DSA-2022-139
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-29092

Vulnerability Analysis

The vulnerability is a local privilege escalation issue rooted in how Dell SupportAssist resolves and loads dependent libraries. The CWE-427 classification points to an uncontrolled search path, where the application searches user-writable directories before trusted system locations. An authenticated low-privileged user can plant a malicious dynamic-link library (DLL) in a location that the SupportAssist process searches, then trigger execution under the elevated service context.

SupportAssist runs components with SYSTEM-level privileges to perform hardware diagnostics, driver updates, and remote support actions. When a vulnerable component loads an attacker-supplied DLL, the injected code inherits those privileges. The result is full administrative control over the endpoint, including the ability to disable security tooling, install persistent backdoors, and access protected user data.

Root Cause

The root cause is improper validation of the library search path used by SupportAssist binaries. The application does not enforce fully qualified paths or signature validation before loading dependent DLLs. Windows then resolves the missing library through its default search order, which can include directories writable by standard users.

Attack Vector

Exploitation requires local access and low privileges on the target system. No user interaction is needed beyond triggering the SupportAssist execution flow, which can be initiated through scheduled tasks, service start events, or user-launched diagnostics. The attacker places a crafted DLL with a name matching a library that SupportAssist attempts to load from an uncontrolled directory. When SupportAssist runs, the malicious DLL is loaded into a privileged process and executes attacker code as SYSTEM. Refer to the Dell Security Advisory DSA-2022-139 for vendor-confirmed technical scope.

Detection Methods for CVE-2022-29092

Indicators of Compromise

Unexpected DLL files in directories adjacent to SupportAssist.exe or its service binaries, especially in user-writable paths
SupportAssist processes loading modules from non-standard paths such as %TEMP%, %APPDATA%, or user profile directories
New SYSTEM-context child processes spawned by SupportAssistAgent.exe or related Dell service binaries shortly after a non-admin user logon

Detection Strategies

Monitor Sysmon Event ID 7 (Image Loaded) for Dell SupportAssist processes loading unsigned or non-Dell-signed DLLs
Hunt for file write events to SupportAssist installation directories originating from non-administrative user contexts
Correlate process creation events where a SupportAssist binary is the parent and the child runs as NT AUTHORITY\SYSTEM but performs non-diagnostic actions such as launching cmd.exe or powershell.exe

Monitoring Recommendations

Inventory all endpoints running Dell SupportAssist and compare installed versions against the fixed builds in DSA-2022-139
Enable PowerShell and command-line auditing to capture post-exploitation activity following SYSTEM-level code execution
Track Dell SupportAssist update telemetry to confirm patched versions are deployed and remain current

How to Mitigate CVE-2022-29092

Immediate Actions Required

Upgrade Dell SupportAssist Client Consumer to a version later than 3.11.0 and Dell SupportAssist Client Commercial to a version later than 3.2.0
Audit endpoints for unauthorized DLLs in SupportAssist directories and remove any unsigned or unexpected modules
Restrict write permissions on SupportAssist installation paths to administrators only

Patch Information

Dell published fixed builds in advisory DSA-2022-139. Customers should install the latest available SupportAssist release through the in-product updater or by downloading from Dell.com. Verify the installed version using Add/Remove Programs or by checking the SupportAssist.exe file properties after deployment.

Workarounds

Uninstall Dell SupportAssist on endpoints that do not require automated Dell diagnostics or remote support
Apply application allowlisting (such as Windows Defender Application Control or AppLocker) to block unsigned DLLs from loading into Dell SupportAssist processes
Enforce least-privilege policies so standard users cannot write to directories searched by SupportAssist binaries

bash

# Verify installed Dell SupportAssist version on Windows
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*SupportAssist*" } | Select-Object Name, Version, Vendor