Windows 10: KB5012170: Windows update error 0x800f0922, UEFI Bios update may resolve it

Microsoft released cumulative updates for all supported versions of Windows on the August 2022 Patch Day. The company did release a second security update for Windows at the day to address issues in Secure Boot DBX.



Installation of the second update may throw the error 0x800f0922 and the update fails to install as a consequence.

Microsoft describes the issue on the known issues and notifications support page for supported operating systems, e.g., for Windows 11 and Windows 10.

When attempting to install KB5012170, it might fail to install, and you might receive an error 0x800f0922.
​

The issue is unrelated to the installation of the cumulative updates for Windows, which Microsoft released on the same day.

Microsoft suggests that administrators may be able to resolve the issue by updating the UEFI bios of the system to the latest version before installing KB5012170. Whether that is possible depends on the installed version of the UEFI bios, and whether an update is available.

The company is investigating the issue currently and plans to "provide an update in an upcoming release".

Secure Boot DBX update


A support page for the Secure Boot DBX update has additional information. The update has been released for several supported client and server versions of the Windows operating system, including Windows 8.1, Windows 10 and Windows 11.

The update improves Secure Boot DBX in Windows:

This security update makes improvements to Secure Boot DBX for the supported Windows versions listed in the "Applies to" section.
​

Windows devices with UEFI based firmware support Secure Boot. Secure Boot is a security feature that protects the boot process of the system. The Secure Boot Forbidden Signature Database (DBX) database "prevents UEFI modules from loading". Microsoft confirms that the KB5012170 update adds modules to DBX.

The update addresses a security feature bypass vulnerability in secure boot by updating the DBX with information about the signatures of the known vulnerable UEFI modules. An attacker could exploit the issue to bypass secure boot and load untrusted software.

An advisory page on Microsoft's website provides additional information on the issue. According to Microsoft, the security issue was found in the GRUB bootloader, which is commonly used by Linux.

To exploit this vulnerability, an attacker would need to have administrative privileges or physical access on a system where Secure Boot is configured to trust the Microsoft Unified Extensible Firmware Interface (UEFI) Certificate Authority (CA).

The attacker could install an affected GRUB and run arbitrary boot code on the target device. After successfully exploiting this vulnerability, the attacker could disable further code integrity checks thereby allowing arbitrary executables and drivers to be loaded onto the target device.
​

Most Windows devices are not in immediate danger judging from the description.

KB5012170 is provided via Windows Update, other update management systems, and as a direct download on the Microsoft Update Catalog website.

Now You: did you install the KB5012170 update on your devices?

Thank you for being a Ghacks reader. The post KB5012170: Windows update error 0x800f0922, UEFI Bios update may resolve it appeared first on gHacks Technology News.

read more...

 

KB5012170: Security update for Secure Boot DBX: August 9, 2022 - Install error - 0x800f0922

I've been fighting the same issues all day. KB5012170 fails to install with error 0x800f0922. Looking through C:\Windows\Logs\CBS\CBS.log reveals errors pointing to BitLocker (which is a red herring) and Secure Boot (the real culprit).

I finally got it to install successfully as follows:

1. Open a cmd.exe or powershell.exe window running as Administrator

2. dism.exe /online /cleanup-image /restorehealth

3. sfc /scannow

4. Reboot

5. Manually download the MSU appropriate for your Windows version directly from the Microsoft Update Catalog here: Microsoft Update Catalog

6. Double click the MSU file to install

This still didn't work for me, but it did clean up the CBS store and allowed me to successfully install the August 2022 Cumulative Update. However, manually installing KB5012170 still failed with the same error as Windows Update in Settings: 0x800f0922

Next, I also performed these additional steps:

7. Reboot into UEFI BIOS

8. Enabled Secure Boot (it was disabled in my case) => Note: This alone didn't work for me. I also needed to do the next step.

9. Clear Secure Boot keys (i.e. reset the Secure Boot keys to default factory settings)

10. Save and exit UEFI BIOS

After this, I repeated Steps 1-6 above and the KB5012170 MSU package successfully installed.

Not sure if this will work for everyone, but since KB5012170 updates the Secure Boot Forbidden Signature Database (DBX) in UEFI, clearing the old and potentially stale boot keys and resetting to factory defaults allowed the update to install required changes to DBX.

Motherboard: Asrock Z87 Extreme6/ac

 

Error 0X800f0922 when installing Windows update KB5012170

Hi B4. I'm Greg, 10 years awarded Windows MVP, here to help you.

You can try these fixes for the error when installing Updates:

https://appuals.com/error-code-0x800f0922-faile...

https://www.dell.com/support/kbdoc/en-us/000129...

Is the Update bothering you? If not then just ignore it and it will eventually get installed. If it's bothering you then you can try installing it from Updates catalog here:

https://www.catalog.update.microsoft.com/Search...

Feel free to ask back any questions. Based on the results you post back I may have other suggestions if necessary.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

 

KB5012170: Security update for Secure Boot DBX: August 9, 2022 - Install error - 0x800f0922

Its temporarily disabling Secure Boot that's allowed me - and others - to install the update.

Loading default factory keys is an important step in allowing Secure Boot to be Enabled.

I'm not sure I would reset them after enabling Secure Boot or understand that doing this removes "old and potentially stale boot keys" - there can either be the factory default keys needed for Windows or custom keys.

Also the DBX seems to be a forbidden signatures database - something different from the keys.

Secure Boot keys settings should be changed with care as doing it the wrong way leads to a boot loops on some systems.