Understanding Virtualization-Based Security in Windows: Addressing CVE-2024-21302

As Windows users, understanding the security mechanisms that protect our systems is crucial. A recent advisory from Microsoft provides important guidance for managing the rollback of Virtualization-Based Security (VBS) related updates, aimed at addressing vulnerabilities that potentially expose systems to threats. Let’s dive into what this means for you and your Windows devices, especially if you’re running Windows 10 or 11.

What is Virtualization-Based Security (VBS)?​

Virtualization-Based Security is a security feature that leverages hardware virtualization to create a secure environment for sensitive operations. This feature helps isolate critical security components from malware and unauthorized access. Essentially, it allows certain security subsystems to run in a secure "container," safeguarding them from potential invaders lurking on your device.
You might wonder: how does this all tie back to the recent developments? Well, a vulnerability was identified that could potentially allow an attacker with administrative privileges to replace essential VBS system files with older versions. This means they could sidestep VBS protections, risking the exfiltration of protected data.

The Recent CVE Alert​

Microsoft's advisory specifically references CVE-2024-21302, noted as a vulnerability affecting the Windows Secure Kernel Mode. It underscores the risk of outdated VBS system files, which could allow attackers to wipe away the advantages of this security feature. To rectify this, Microsoft emphasizes the need to revoke vulnerable files and block any rollback to these outdated versions.

How Will This Affect You?​

Scope of Impact: The potential fallout of this vulnerability isn’t limited to a few specific devices. All Windows machines that support VBS—ranging from Windows 10 through to the latest versions of Windows 11—are at risk. This includes both physical devices and virtual machines, making it a significant concern for enterprise users relying on VBS for heightened security.
Fortunately, Microsoft has provided detailed mitigation strategies to help users and administrators address this vulnerability effectively.

Available Mitigations​

1. Microsoft-Signed Revocation Policies​

One of the primary strategies to combat this vulnerability is deploying a Microsoft-signed revocation policy, specifically SkuSiPolicy.p7b. This policy works by bolstering the integrity of user-mode binaries, ensuring that only updated files can be loaded by the OS. This essentially guards against any unauthorized rollbacks to unsecured, older files.

Important Notes:​

• If applied incorrectly or if the device lacks the necessary updates, you might encounter boot failures, resulting in a potential boot loop. It’s pivotal to thoroughly test and plan rollout strategies for environments where VBS is active.

2. UEFI Locking​

You can implement a UEFI lock alongside the revocation policy. However, be mindful: once this lock is applied, rolling back to previous states or uninstalling updates becomes nearly impossible without disabling Secure Boot, which underscores the critical need to test and prepare adequately.

3. Audit Policies​

Before enforcing the Microsoft-signed policy, it’s advisable to deploy audit policies to identify compatibility issues. This proactive step allows you to adjust systems to ensure they accommodate any applications or scripts that might conflict with the new security policies.
For Windows administrators managing deployment:

• Test with the provided SiPolicy.p7b audit policy first.
• Always back up your BitLocker recovery key if using BitLocker encryption.

Best Practices Moving Forward​

Here are some best practices to keep in mind while applying these measures:

• Confirm VBS Status: To check whether VBS is enabled on your device, utilize the Msinfo32.exe tool or PowerShell. Issues may arise if it's not properly enabled.
• Continued Updates: Ensure that Windows devices regularly receive updates, specifically those released after October 8, 2024, which include the necessary updates for the revocation policies.
• External Media Management: After applying necessary updates, ensure any external boot media used aligns with the updated settings. Failure to do so could lead to boot complications.

Conclusion​

The advisory regarding the rollback of Virtualization-Based Security updates is a clarion call for users to remain vigilant and proactive. As threats evolve, so must our defenses. By understanding and implementing Microsoft’s guidance, Windows users can ensure their systems are fortified against vulnerabilities—keeping your sensitive data secure and your devices robust.
So, the next time your system prompts an update, remember: it’s not just about keeping pace with software improvements; it’s about securing your digital realm against lurking dangers. Make sure to stay informed and engage actively with Microsoft’s recommendations to navigate these complexities seamlessly!

---

Source: Microsoft Support Guidance for blocking rollback of Virtualization-based Security (VBS) related security updates - Microsoft Support