Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Why was the fix for this vulnerability disabled and how can I apply protections to address this issue?
When customers applied the fix for this vulnerability to their devices, we received feedback about firmware incompatibility issues that were causing BitLocker to go into recovery mode on some devices. As a result, with the release of the August 2024 security updates we are disabling this fix. Customers who want this protection can apply the mitigations described in KB5025885.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data.
Security updates
10.0.17763.6054 — https://support.microsoft.com/help/5040430
10.0.20348.2582 — https://support.microsoft.com/help/5040437
10.0.22000.3079 — https://support.microsoft.com/help/5040431
10.0.19044.4651 — https://support.microsoft.com/help/5040427
10.0.22621.3880 — https://support.microsoft.com/help/5040442
10.0.25398.1009 — https://support.microsoft.com/help/5040438
10.0.10240.20710 — https://support.microsoft.com/help/5040448
10.0.14393.7159 — https://support.microsoft.com/help/5040434
6.2.9200.24975 — https://support.microsoft.com/help/5040485
6.3.9600.22074 — https://support.microsoft.com/help/5040456
Vulnerabilities 1
-
Medium 6.8
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
Revision history
-
#2
Added an FAQ to explain that because of firmware incompatibility issues that were causing BitLocker to go into recovery mode on some devices, the fix for CVE-2024-38058 has been disabled with the release of the August 2024 security updates. Customers who want to be protected from the vulnerability can apply the mitigations described in [KB5025885](https://support.microsoft.com/help/5025885).
-
#1
Information published.
References
-
CVE-2024-38058 BitLocker Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38058
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss