CVE-2024-52535: Dell SupportAssist Privilege Escalation

CVE-2024-52535 Overview

Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could potentially exploit this vulnerability, gaining privilege escalation, leading to arbitrary deletion of files and folders from the system.

Critical Impact

This symlink attack vulnerability enables low-privileged users to escalate privileges and perform arbitrary file and folder deletion, potentially leading to system instability, data loss, or further exploitation.

Affected Products

• Dell SupportAssist for Home PCs versions 4.6.1 and prior
• Dell SupportAssist for Business PCs versions 4.5.0 and prior
• Dell SupportAssist software remediation component

Discovery Timeline

• December 25, 2024 - CVE-2024-52535 published to NVD
• January 29, 2025 - Last updated in NVD database

Technical Details for CVE-2024-52535

Vulnerability Analysis

This vulnerability affects Dell SupportAssist's software remediation component, which is designed to automatically detect and fix common system issues on Dell computers. The flaw exists in how the component handles file operations, failing to properly validate symbolic links before performing privileged operations.

When the SupportAssist software remediation component executes with elevated privileges, it performs file operations in directories that may be manipulated by low-privileged users. An attacker can create symbolic links (symlinks) in these directories that point to sensitive system files or folders. When the remediation component processes these symlinked paths, it follows the links and performs operations on the target locations with system-level privileges.

The vulnerability is classified under CWE-61 (UNIX Symbolic Link Following) and CWE-59 (Improper Link Resolution Before File Access), both of which relate to insecure handling of filesystem links.

Root Cause

The root cause of this vulnerability lies in the software remediation component's failure to implement proper symbolic link validation before performing file system operations. The component does not verify whether paths it operates on contain symbolic links pointing to unauthorized locations, allowing attackers to redirect privileged operations to arbitrary file system locations.

This represents a Time-of-Check Time-of-Use (TOCTOU) race condition scenario where the attacker can modify the file system state between when the application checks the path and when it uses it.

Attack Vector

The attack requires local access to the system with a low-privileged user account. The attacker exploits the vulnerability through the following mechanism:

1. The attacker identifies directories used by the SupportAssist remediation component for temporary or operational files
2. The attacker creates a symbolic link in these directories pointing to a target file or folder they wish to delete (such as critical system files or security software components)
3. When the SupportAssist remediation process runs with elevated privileges, it follows the symbolic link and performs deletion operations on the attacker-specified targets
4. The attacker achieves privilege escalation by manipulating system state through arbitrary file deletion

This attack can be leveraged to disable security software, corrupt system files, or create conditions for further exploitation.

Detection Methods for CVE-2024-52535

Indicators of Compromise

• Unexpected symbolic links appearing in Dell SupportAssist working directories or temp folders
• System log entries showing unusual file deletion operations by the SupportAssist process
• Missing or corrupted critical system files following SupportAssist remediation activities
• Evidence of symbolic link creation by non-administrative user accounts in privileged directories

Detection Strategies

• Monitor file system operations from Dell SupportAssist processes for unusual deletion patterns
• Implement auditing for symbolic link creation in directories used by SupportAssist components
• Deploy endpoint detection rules to identify TOCTOU attack patterns involving symlinks
• Track integrity of critical system files and folders that could be targeted for deletion

Monitoring Recommendations

• Enable Windows audit policies for file system access and object manipulation
• Configure SentinelOne to monitor Dell SupportAssist process behavior for anomalous file operations
• Implement file integrity monitoring on critical system directories
• Set up alerts for symbolic link creation in application data directories by low-privileged users

How to Mitigate CVE-2024-52535

Immediate Actions Required

• Update Dell SupportAssist for Home PCs to version 4.6.2 or later immediately
• Update Dell SupportAssist for Business PCs to version 4.5.1 or later immediately
• Review systems for signs of compromise or unexpected file deletions
• Audit user accounts with local access for suspicious activity

Patch Information

Dell has released security updates to address this vulnerability. The patches are available through the Dell Security Update Advisory. Organizations should update Dell SupportAssist for Home PCs to version 4.6.2 or later and Dell SupportAssist for Business PCs to version 4.5.1 or later.

Workarounds

• Restrict local access to systems with vulnerable Dell SupportAssist installations
• Consider temporarily disabling the software remediation feature until patches can be applied
• Implement strict access controls on directories used by Dell SupportAssist
• Deploy application control policies to prevent unauthorized symbolic link creation in sensitive directories

# Check installed Dell SupportAssist version on Windows
wmic product where "name like '%SupportAssist%'" get name,version

# Review symbolic links in common Dell SupportAssist directories
dir /AL /S "C:\Program Files\Dell\SupportAssist\"
dir /AL /S "C:\ProgramData\Dell\SupportAssist\"