"Perfect" Windows downgrade attack turns fixed vulnerabilities into zero-days
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-21302 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this vulnerability. An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. Update: July 10, 2025 Microsoft has addressed this vulnerability for Windows 10 1507, Windows 10, version 1607, Windows 10, version 1809, and Windows Server 2016 and Windows Server 2018. This ensures that mitigations are available to protect all supported versions of Windows 10 and Windows 11 from this vulnerability. See the available mitigations and deployment guidelines described in KB5042562: Guidance for blocking rollback of virtualization-based security related updates. Update: August 13, 2024 Microsoft has released the August 2024 security updates that include an opt-in revocation policy mitigation to address this vulnerability. Customers running affected versions of Windows are encouraged to review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if this opt-in policy meets the needs of their environment before implementing this mitigation. There are risks associated with this mitigation that should be understood prior to applying it to your systems. Detailed information about these risks is also available in KB5042562. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, and higher based systems including Azure Virtual Machines (VM) that support VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated versions. Successful... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21302 NVD description · AI analysis pending | 6.7 | 2% |
| — | ||
| CVE-2024-38202 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privilege Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further updates regarding mitigations for this vulnerability, this CVE will be updated and customers will be notified. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert if an update occurs. Details A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Update potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38202 NVD description · AI analysis pending | 7.3 | 2% |
| — |
Full article775 words · extracted from helpnetsecurity.com · click to collapse
A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that.
A downgrade attack exploiting the Windows Update process
The direction of SafeBreach researcher Alon Leviev’s probing was inspired by the BlackLotus UEFI bootkit, which was able to bypass the UEFI Secure Boot by exploiting a vulnerability, as well as disable Windows security mechanisms (e.g., BitLocker, HVCI, and Windows Defender) and persist on compromised machines.
He concentrated on finding ways to co-opt the Windows Update process, so that the attack cannot be spotted by Windows’ security mechanisms or endpoint security solutions.
The Windows Update process, he outlined, is started by the machine “putting in” a request for an update in an update folder located on the machine. Once its integrity is verified by Microsoft’s update server, that same folder is saved to a server-controlled folder, along with a list – Pending.xml – of update actions to be performed (such as create/delete/move files, create/delete registry keys and values, etc.) when the OS is rebooted.
After testing different approaches, he discovered the action list path in the registry, along with a key – PoqexecCmdline – that holds the executable that parses the list and the list path.
“I then looked at the security attributes of this key and noticed that it is not Trusted Installer enforced! This would allow me to control all the update actions,” he explained. “In order to downgrade, I could use the hard-link file action and the source would replace the destination.”
Then he simply updated the system with a custom, downgrading action list. The attack was not detected by security mechanisms, as it was performed in a legitimate way, and nobody would know that the machine is not fully updates, since – technically – an update did happen.
He also found that he could patch the action list parser – poqexec.exe – to install empty updates, so that newer updates would not get installed. Lastly, he discovered he could patch the integrity and repair utility – SFC.exe – so that it would no longer detect any corruptions.
“Armed with these capabilities, I then managed to downgrade critical OS components, including dynamic link libraries (DLLs), drivers, and even the NT kernel. I then aimed higher and found that the entire virtualization stack was at risk as well. I successfully downgraded Credential Guard’s Isolated User Mode Process, Secure Kernel, and Hyper-V’s hypervisor to expose past privilege escalation vulnerabilities,” he outlined.
He also find ways to disable Windows virtualization-based security (VBS), Credential Guard and Hypervisor-Protected Code integrity (HVCI), by bypassing their UEFI locks.
“As a result, I was able to make a fully patched Windows machine susceptible to thousands of past vulnerabilities, turning fixed vulnerabilities into zero-days and making the term ‘fully patched’ meaningless on any Windows machine in the world,” he concluded.
Two zero-days, yet unpatched
The researcher exploited two currently unpatched zero-day elevation of privilege vulnerabilities (CVE-2024-38202, CVE-2024-21302) in the Windows Update Stack and Windows Secure Kernel, respectively, to reintroduce previously mitigated vulnerabilities, circumvent some VBS features, and exfiltrate data protected by VBS.
He also created a tool – Windows Downdate – that allowed him to do it.
Leviev shared his discoveries with Microsoft back in February 2024, and the company is developing a security update to mitigate the two flaws. In the meantime, customers are advised to reduce the risk of exploitation by performing permissions audits and implement an Access Control List or Discretionary Access Control Lists.
“Microsoft is not aware of any attempts to exploit this vulnerability. However, a public presentation regarding this vulnerability was hosted at Black Hat on August 7, 2024. The presentation was appropriately coordinated with Microsoft but may change the threat landscape,” the company said.
But Leviev says his research should be a wake-up call for developers of other operating systems.
“Design features within an OS should always be reviewed and regarded as a relevant attack surface, regardless of how old the feature may be,” he noted.
“The downgrade attack I was able to achieve on the virtualization stack within Windows was possible due to a design flaw that permitted less privileged virtual trust levels/rings to update components residing in more privileged virtual trust levels/rings. This was very surprising, given Microsoft’s VBS features were announced in 2015, meaning the downgrade attack surface I discovered has existed for almost a decade.”
UPDATE (August 30, 2024, 08:40 a.m. ET):
SafeBreach has made Windows Downdate available on GitHub.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/08/08/windows-downgrade-attack/