CVE-2024-20666

MEDIUM

BitLocker Security Feature Bypass Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-20666 has a selected CVSS score of 6.6 (medium); EIP currently links 3 repository PoCs.

Description

BitLocker Security Feature Bypass Vulnerability

Description source: GitHub Advisory

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 3, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
3

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 11, 2024 · Source: CVE List

Affected products and versions

Showing 12 of 16
ProductSourceVersion range

Windows

Browse Microsoft / Windows
VulnCheckVersion data not supplied

Windows 10 Version 1507

Browse Microsoft / Windows 10 Version 1507
CVE List10.0.10240.0 to < 10.0.10240.20402affected

Windows 10 Version 1607

Browse Microsoft / Windows 10 Version 1607
CVE List10.0.14393.0 to < 10.0.14393.6614affected

Windows 10 Version 1809

Browse Microsoft / Windows 10 Version 1809
CVE List10.0.17763.0 to < 10.0.17763.5329affected
10.0.0 to < 10.0.17763.5329affected

Windows 10 Version 21H2

Browse Microsoft / Windows 10 Version 21H2
CVE List10.0.19043.0 to < 10.0.19044.3930affected

Windows 10 Version 22H2

Browse Microsoft / Windows 10 Version 22H2
CVE List10.0.19045.0 to < 10.0.19045.3930affected

Windows 11 Version 23H2

Browse Microsoft / Windows 11 Version 23H2
CVE List10.0.22631.0 to < 10.0.22631.3007affected

Windows 11 version 21H2

Browse Microsoft / Windows 11 version 21H2
CVE List10.0.0 to < 10.0.22000.2713affected

Windows 11 version 22H2

Browse Microsoft / Windows 11 version 22H2
CVE List10.0.22621.0 to < 10.0.22621.3007affected

Windows 11 version 22H3

Browse Microsoft / Windows 11 version 22H3
CVE List10.0.22631.0 to < 10.0.22631.3007affected

Windows Server 2016

Browse Microsoft / Windows Server 2016
CVE List10.0.14393.0 to < 10.0.14393.6614affected

Windows Server 2016 (Server Core installation)

Browse Microsoft / Windows Server 2016 (Server Core installation)
CVE List10.0.14393.0 to < 10.0.14393.6614affected

Proofs of concept

3

Repository PoCs

GitHubtazxtazxedu/WinRE-FixRepository PoCby tazxtazxedu1Scanner3 files

21.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a PowerShell script (Winre-Fix.ps1) and its README that automates resizing the Windows Recovery Environment (WinRE) partition to allow installation of security updates, including the patch for CVE-2024-20666. It checks for sufficient unallocated disk space, disables WinRE, deletes the old recovery partition, extends the C: drive, creates a new recovery partition, and re-enables WinRE. It does not contain code to exploit the BitLocker bypass vulnerability; it only prepares the system to receive the official Microsoft patch.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a PowerShell script (Winre-Fix.ps1) that automates moving the Windows Recovery Environment (WinRE) to a new partition. The script performs standard disk management operations (checking unallocated space, disabling/enabling WinRE via reagentc, deleting/creating partitions, formatting, setting GPT attributes) and includes safety checks (administrator check, backup confirmation, size sanity checks). No concealed executable behavior, credential theft, persistence mechanisms, unrelated remote access, or deceptive payloads were observed. The script's actions are consistent with its stated purpose of fixing WinRE partition issues related to CVE-2024-20666.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareMicrosoft WindowsWindows Recovery Environment (WinRE)
Attack typesnone
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's purpose is to fix the WinRE partition size to allow installation of security updates (KB5034441/KB5028997) that address CVE-2024-20666. It performs disk partition management and WinRE configuration checks and modifications. It does not contain any code that exploits the BitLocker security feature bypass; it only prepares the system to receive the patch. This is consistent with a scanner (or more precisely, a remediation tool) that checks for and resolves the prerequisite condition for the update, not an exploit.

README.md:15-19Winre-Fix.ps1:7-10

Requirements

  • Must be run as AdministratorWinre-Fix.ps1:89-92
  • Requires GPT disk and UEFI boot modeWinre-Fix.ps1:44-45
  • Requires at least 1.2 GB unallocated space on Disk 0Winre-Fix.ps1:46

Observed behavior

  • Checks for unallocated space on Disk 0 and exits if none foundWinre-Fix.ps1:127-157
  • Scans partitions for the Recovery GPT type to locate the existing WinRE partitionWinre-Fix.ps1:200-214
  • Disables WinRE using reagentc /disableWinre-Fix.ps1:247-248
  • Deletes the old recovery partitionWinre-Fix.ps1:260-261
  • Extends the C: drive, reserving 1 GB for a new recovery partitionWinre-Fix.ps1:287-295
  • Creates a new partition, formats it as NTFS, and sets the Recovery GPT type and hidden attributeWinre-Fix.ps1:302-328
  • Re-enables WinRE using reagentc /enableWinre-Fix.ps1:347-348
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Behavior
Payload withheldStandard Windows Recovery Environment management commands, consistent with the script's stated purpose.Winre-Fix.ps1:247-248Winre-Fix.ps1:347-348
Script Behavior
Payload withheldNecessary for moving the recovery partition; includes user confirmation and safety checks.Winre-Fix.ps1:261Winre-Fix.ps1:294Winre-Fix.ps1:302
Script Behavior
Payload withheldLogging of operations, no sensitive data exfiltration observed.Winre-Fix.ps1:57-58Winre-Fix.ps1:69
Review boundaries

What the analysis did not establish

  • One file (likely a license or .gitignore) was omitted from the text evidence; its content is not material to classification.
  • The evidence does not include execution output or verification that the script successfully enables the update.
  • One file (metadata only, 1071 bytes) was not provided as text; its content is unknown.
  • The review is based solely on static analysis of the supplied text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubnnotwen/Script-For-CVE-2024-20666Repository PoCby nnotwen4Not analyzed3 files

20.8 KiB

GitHub
PoC details
GitHubinvaderslabs/CVE-2024-20666Repository PoCby invaderslabs1Not analyzed3 files

10.7 KiB

GitHub
PoC details

References

2