PT-2015-2323 · Microsoft · Windows 10+8

Published 2015-10-13 · Updated 2019-05-15 · CVE-2015-2552

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8 through 10 Microsoft Windows Server versions 2012 through 2012 R2 Microsoft Windows RT versions 8 through 8.1

Description The issue allows physically proximate attackers to bypass the Trusted Boot protection mechanism, interfering with the integrity of code, BitLocker, Device Encryption, and Device Health Attestation. This is achieved via a crafted Boot Configuration Data (BCD) setting. An attacker who successfully exploits this issue could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. Furthermore, an attacker could bypass Trusted Boot integrity validation for BitLocker and Device Encryption security features.

Recommendations For Microsoft Windows versions 8 through 10, update the system to enforce the Windows Trusted Boot policy properly. For Microsoft Windows Server versions 2012 through 2012 R2, ensure that the Boot Configuration Data (BCD) settings are properly configured to prevent exploitation. For Microsoft Windows RT versions 8 through 8.1, restrict access to the BCD settings to minimize the risk of exploitation. As a temporary workaround, consider disabling the test-signed executables and drivers until a patch is available. Restrict access to the BitLocker and Device Encryption security features to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2015-11688

CVE-2015-2552

Affected Products

Bitlocker

Device Encryption

Windows

Windows 10

Windows 8

Windows Rt 8

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

References · 9

• 🔥 http://packetstormsecurity.com/files/133962/Microsoft-Trusted-Boot-Security-Feature-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2552 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-111 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2552 · Security Note
• https://bdu.fstec.ru/vul/2015-11688 · Security Note
• http://securitytracker.com/id/1033805 · Note
• http://technet.microsoft.com/security/bulletin/MS15-111 · Note
• http://securityfocus.com/archive/1/536678/100/0/threaded · Note
• http://technet.microsoft.com/security/bulletin/ms15-111 · Note