CVE-2022-41099: BitLocker Security Feature Bypass Vulnerability

Overview

Severity

Medium (CVSS 4.6)

CVSS Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2022-Nov

Released

2022-11-08

Last Updated

2023-03-16

EPSS Score

2.27% (percentile: 84.6%)

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data. Are there additional steps that I need to take to be protected from this vulnerability? Yes. You must apply the applicable Windows security update to your Windows Recovery Environment (WinRE). For more information about how to apply the WinRE update, see Add an update package to Windows RE. IMPORTANT: End users and enterprises who are updating Windows devices which are already deployed in their environment can instead use the latest Windows Safe OS Dynamic Updates to update WinRE when the partition is too small to install the full Windows update. You can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog. Can a bootable Windows ISO or USB flash drive that boot to Windows RE be used to exploit this vulnerability? No. The exploit is only possible with the winre.wim on the recovery partition of the device. Can a vulnerable version of WinRE WIM file be used to exploit this vulnerability? No. A BitLocker encrypted drive cannot be accessed via an arbitrary WinRE WIM file hosted on an external drive. Please complete all steps in [Microsoft Learn | Add an Update to Windows RE | Apply the update to a running PC to ensure that the updated Windows RE image is turned on and correctly configured for your Windows installation. If TPM+PIN BitLocker protectors are being used, can the vulnerability be exploited if the attacker does not know the TPM PIN? No. To exploit the vulnerability the attacker needs to know the TPM PIN if the user is protected by the BitLocker TPM+PIN. Is there a way I can automate the process of updating WinRE on my Windows devices which have already been deployed? Yes. Microsoft has developed a sample script that can

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 4 repositories

Affected Products (22)

Windows

• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems

Security Updates (6)

• 5019966
• 5019959
• 5019961
• 5019980
• 5019970
• 5019964

Acknowledgments

Anonymous

Revision History

• 2022-11-08: Information published.
• 2023-01-10: The following updates have been made: 1) Added an FAQ with further steps customers need to take to protect the Windows Recovery Environment (WinRE) from this vulnerability. 2) Added an FAQ to further clarify that offline images are not affected by this vulnerability. These are informational changes only.
• 2023-01-19: Updated the FAQs to further clarify the update guidance for this CVE. This is an informational change only.
• 2023-02-07: The following updates have been made: 1) Added an FAQ to explain that a BitLocker encrypted drive cannot be accessed via an artibrary WinRE WIM hosted on an external drive. 2) Revised FAQ to clarify that the exploit is only possible with the winre.wim on the recovery partition of the device.
• 2023-02-24: Added an FAQ to explain that the vulnerability cannot be exploited if the user is protected by BitLocker TPM+PIN. This is an informational change only.
• 2023-03-16: Added an FAQ to inform customers that a sample script is now available to help automate updating WinRE from the running Windows OS. See KB5025175: Updating the WinRE partition on deployed devices to address security vulnerabilities in CVE-2022-41099 for more information.