CVE-2022-29127: BitLocker Security Feature Bypass Vulnerability

CVE-2022-29127 is a security feature bypass vulnerability in BitLocker, rated Important by Microsoft, with a CVSS 3.1 base score of 4.2 (Medium). An attacker can exploit it by an attacker with physical access, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.86% probability of exploitation activity in the next 30 days, higher than 58% of all scored vulnerabilities. Microsoft released the fix on 10 May 2022 in the May 2022 Patch Tuesday, delivered through 16 security updates (KB5013941, KB5013945, KB5013942, KB5013944 and more). It affects 42 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-29127

Severity

Medium CVSS 4.2

Microsoft severity

Important

Impact

Security Feature Bypass

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

0.86% (percentile 58%)

CISA KEV

Not listed

Released

10 May 2022

Last updated

10 May 2022

Patch Tuesday

May 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-29127 at 4.2 (temporal 3.7) using CVSS 3.1. Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to a powered off system could exploit this vulnerability to gain access to encrypted data.

Affected products (42)

Windows

ESU

Security updates (16)

• KB5013941 (Security Update)
• KB5013945 (Security Update)
• KB5013942 (Security Update)
• KB5013944 (Security Update)
• KB5013943 (Security Update)
• KB5013963 (Security Update)
• KB5013952 (Security Update)
• KB5014012 (Monthly Rollup)
• KB5013999 (Security Only)
• KB5014011 (Monthly Rollup)
• KB5014001 (Security Only)
• KB5014025 (ServicingStackUpdate)
• KB5014010 (Monthly Rollup)
• KB5014006 (Security Only)
• KB5014017 (Monthly Rollup)
• KB5014018 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

4.2 (MEDIUM)

Published to NVD

10 May 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29127
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29127 (Patch, Vendor Advisory)

Acknowledgments

• Matt Wesemann with Microsoft

Revision history

Related vulnerabilities

Other BitLocker vulnerabilities

• CVE-2024-43513: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.4, October 2024)
• CVE-2024-38058: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.8, July 2024)
• CVE-2024-20665: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.1, April 2024)
• CVE-2024-20666: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.6, January 2024)
• CVE-2023-21563: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.8, January 2023)
• CVE-2022-41099: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 4.6, November 2022)
• CVE-2022-22048: BitLocker Security Feature Bypass Vulnerability (Medium, CVSS 6.1, July 2022)

More from the May 2022 Patch Tuesday

• CVE-2022-26925: Windows LSA Spoofing Vulnerability (High, CVSS 8.1, exploited)
• CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-22713: Windows Hyper-V Denial of Service Vulnerability (Medium, CVSS 5.6)
• CVE-2022-26937: Windows Network File System Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-22017: Remote Desktop Client Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2022-26923: Active Directory Domain Services Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-23270: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2022-29104: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-29132: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-23279: Windows ALPC Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-29142: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2022-29114: Windows Print Spooler Information Disclosure Vulnerability (Medium, CVSS 5.5)

All vulnerabilities of this release: May 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-29127
• NIST NVD: CVE-2022-29127
• CVE.org record: CVE-2022-29127