Friend
Professional
- Messages
- 2,653
- Reaction score
- 851
- Points
- 113
BitLocker vulnerability fixed, but at what cost.
Microsoft has disabled a fix for a vulnerability in BitLocker due to firmware issues that caused devices to enter recovery mode.
The BitLocker security bypass vulnerability CVE-2024-38058 (CVSS score: 6.8) allows attackers to gain access to encrypted data while physically accessing the device.
After installing the fix, computers suddenly entered BitLocker recovery mode. According to Microsoft, the main reason is incompatibility with certain firmware versions. The company decided to temporarily disable the fix for this vulnerability in the July Patch Tuesday.
Microsoft encourages users who want to protect their systems to take advantage of the risk mitigation measures outlined in Bulletin KB5025885. Instead of installing the standard security update, users now need to go through a four-step procedure that includes rebooting the device 8 times.
Moreover, on devices with Secure Boot enabled, you will not be able to undo the measures taken, even if you try to reinstall the operating system. Even formatting the disk won't remove the changes you made. Microsoft strongly recommends that you thoroughly test all the steps described in the documentation before applying them to avoid irreversible consequences.
Source
Microsoft has disabled a fix for a vulnerability in BitLocker due to firmware issues that caused devices to enter recovery mode.
The BitLocker security bypass vulnerability CVE-2024-38058 (CVSS score: 6.8) allows attackers to gain access to encrypted data while physically accessing the device.
After installing the fix, computers suddenly entered BitLocker recovery mode. According to Microsoft, the main reason is incompatibility with certain firmware versions. The company decided to temporarily disable the fix for this vulnerability in the July Patch Tuesday.
Microsoft encourages users who want to protect their systems to take advantage of the risk mitigation measures outlined in Bulletin KB5025885. Instead of installing the standard security update, users now need to go through a four-step procedure that includes rebooting the device 8 times.
Moreover, on devices with Secure Boot enabled, you will not be able to undo the measures taken, even if you try to reinstall the operating system. Even formatting the disk won't remove the changes you made. Microsoft strongly recommends that you thoroughly test all the steps described in the documentation before applying them to avoid irreversible consequences.
Source
