ReVault Flaw Exposed Millions of Dell Laptops to Malicious Domination

2 months ago 6

In this interview from Black Hat USA 2025, Philippe Laulheret, a senior vulnerability researcher at Cisco Talos, discusses his discovery of the "ReVault" vulnerability affecting millions of Dell business laptops.

Laulheret found that the Control Vault (also called a unified secure hub) — a control board connecting peripherals like fingerprint readers and smart card readers to Dell Latitude and Precision laptops — contained multiple security flaws that allow any user to communicate with the board through undocumented APIs, potentially leading to memory corruption, code execution, extraction of secret keys, and permanent firmware modification.

The vulnerabilities have been patched through Windows updates, with both Dell and Broadcom (the chip manufacturer) responding quickly to Laulheret's findings. However, the case highlights the security risks posed by undocumented firmware in embedded components that operate invisibly to most users, emphasizing the importance of investigating these often-overlooked attack surfaces in modern computing devices.

Full Transcript: Millions of Dell Laptops Affected by Major Firmware Bug

This transcript has been edited for clarity.

Becky Bracken: Hello, and welcome to the Dark Reading News Desk from Black Hat USA 2025 at Mandalay Bay in Las Vegas. We are happy to have you join us for an interesting conversation with Philippe Laulheret, senior vulnerability researcher at Cisco Talos. He’s here to tell us about his blockbuster new research, “ReVault! Compromised by Your Secure SoC.” Welcome. Happy to have you.

Philippe Laulheret: Thank you for having me.

Bracken: This is a big deal. It's actually a flaw that affects firmware in millions of Dell laptops, is that correct?

Laulheret: Yes, it affects the control boards that connect peripherals. Something I found interesting is that any user on the machine can talk with the board and send commands to it, and all of that is not documented. I had to research that. And any user can send comments to the board.

Bracken: You can send comments to the board? How do you do that?

Laulheret: You have user APIs that you can call. When you install the driver for control, it comes with a bunch of code. The idea here is a normal user doesn't know how to use it, but the system comes with files that you can load and send, and they export commands that you can execute to communicate with the board.

Bracken: And with that ability to communicate with the board, a malicious actor could do what?

Laulheret: If it's a malicious user, you can send malicious commands, or exploit bugs that are running in the firmware that will corrupt memory inside and allow code execution on the chip. You can run your own code.

From there, you can retrieve the secret keys that are stored in the chip that are unique to each device. That board could then be compromised, and from there, attackers could permanently change the firmware running on the chip. You could reinstall Windows but it would still be modified.

Then, you can send malicious command back to Windows, which would compromise things running with the highest privileges on Windows.

I have a cute little demo, where you can make it think that any finger that touches the fingerprint reader is totally the right user, and it logs you in.

Bracken: Because this is a piece of equipment that's running without the average user even knowing about it, what drew you to research this and look into it?

Phillippe Laulheret: I think it's basic curiosity. I wanted to find a new research project, and I was looking at a laptop. And I was looking at what's running by default as a normal user. And I found services that were running with security mitigations missing.

You have something called ASLR, which is address space layout randomization. Basically it's geared to make exploitation harder. And it's pretty standard in the industry. You'd expect that on everything. But for the specific services that are meant to talk with the control board, that was missing and I was like, "That looks interesting."

I started looking at the install files for Control Vault and see what's the whole thing. And I noticed that it would come with its own firmware file. The code that's meant to run on the chip. And half of it was in plain text or clear text. I could just load it into my reversing tools. But part of it was encrypted, and that's the main thing — that this was encrypted. And I was like, "I really want to decrypt it to see what's in there." It's curiosity. And I managed to do it. And that's where I started looking for vulnerabilities in the main stuff that I decrypted. And finding potential bugs. And that led up to where we are.

ReVault consists of five CVEs, and I tied three together to achieve what I just described. One was a memory corruption in the firmware, and one was a stack overflow in a different function. And I combined the two in order to exploit the one function on the firmware to get code execution. And then there was a third one that was more on the host side that I could use to get into Windows.

Bracken: At what point did you realize this was potentially going to affect millions of laptops, largely in businesses and government?

Laulheret: The actual consequence of, "Oh yeah, it's going to be found in a lot of places" came really late in the process.

Bracken: Has this has been patched? What did Dell say to you?

Laulheret: I think they're really receptive. Dell is the manufacturer, but the chip is Broadcom, and the firmware is written by Broadcom. From an operations perspective it's a little challenging because you have multiple actors. And I think Broadcom was quick with their patches, and Dell was successful sharing that with the customers.

Bracken: Anyone now who's running these Dell laptops can feel confident that these vulnerabilities have been patched?

Laulheret: Yeah. The vulnerabilities we're talking about today were patched in Windows. The laptop updated automatically.

Bracken: Congratulations. This is a huge find. And thank you for joining us at the Dark Reading News Desk. It's been a delight.

Laulheret: Thank you for having me.

Read Entire Article