Windows 10: The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed

GHacks · Aug 13, 2024

Microsoft has released security updates for all supported client and server versions of Windows. Other company products, including Microsoft Office, have received security updates as well.

Our monthly overview is designed to be the starting point for system administrators and home users alike. Learn about the released updates and potential issues that may come along with them before you install the updates.

Included is an Excel spreadsheet with released security updates, link to support pages and direct downloads, and much more.

Tip: you can check out the July 2024 overview here.

Microsoft Windows Security Updates: August 2024

You may download the following Excel spreadsheet to get a list of released updates. Click on the following link to download the archive to the local device: Windows Security Updates August 2024 Excel spreadsheet

Executive Summary

Microsoft released a total of 90 security updates for various Microsoft products and 12 security updates from non-Microsoft issues (e.g. Chromium).

Windows clients with issues are: Windows 10 version 1607, 1809, 21H2, and 22H2, Windows 11 version 21H2, Windows 11 version 24H2.

Windows Server clients with issues: Windows Server 2008, Windows Server 2012, Windows Server 2019, and Windows Server 2022

Product overview

Each supported version of Windows and their critical vulnerabilities are listed below.

Windows 10 version 22H2: 54 vulnerabilities, 4 critical, 49 important, and 1 moderate

Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences -- CVE-2022-3775

Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass -- CVE-2023-40547

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability -- CVE-2024-38140

Windows TCP/IP Remote Code Execution Vulnerability -- CVE-2024-38063

Windows 11 version 22H2: 55 vulnerabilities, 4 critical, 50 important, and 1 moderate

same as Windows 10 version 22H2

Windows 11 version 23H2: 55 vulnerabilities, 4 critical, 50 important, and 1 moderate

same as Windows 10 version 22H2

Windows 11 version 24H2: 47 vulnerabilities, 4 critical, 43 important

same as Windows 10 version 22H2

Windows Server products

Windows Server 2008 R2 (extended support only): 30 vulnerabilities: 2 critical, 28 important

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability -- CVE-2024-38140

Windows TCP/IP Remote Code Execution Vulnerability -- CVE-2024-38063

Windows Server 2012 R2 (extended support only): vulnerabilities: critical and important

unknown

Windows Server 2016: 54 vulnerabilities: 4 critical, 49 important, and 1 moderate

Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences -- CVE-2022-3775

Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass -- CVE-2023-40547

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability -- CVE-2024-38140

Windows TCP/IP Remote Code Execution Vulnerability -- CVE-2024-38063

Windows Server 2019: 56 vulnerabilities: 4 critical, 51 important, and 1 moderate

same as Windows Server 2016

Windows Server 2022: 60 vulnerabilities: 4 critical, 55 important, and 1 moderate

same as Windows Server 2016

Windows Security Updates

Windows 10 version 22H2

Support Page: KB5041580

Updates and improvements:

Fixed the BitLocker recovery screen issue.

"Use my windows user account" is not available on the lock screen to connect to Wi-Fi.

NetJoinLegacyAccountReuse Registry key removed. See this support page.

This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. Is not installed on systems that dual boot Windows and Linux. Older Linux versions may not boot after the update is installed.

Windows 11 version 22H2 and 23H2

Support Page: KB5041585

Updates and improvements:

Fixed the BitLocker recovery screen issue.

Drag pinned apps from the Start menu to the taskbar.

Press Windows-T while the taskbar is selected and then a letter to jump straight to the first matching app on the taskbar.

End Task no longer shows a responding dialog. Needs to be enabled under Settings > System > For Developers.

Right-clicking a tab displays an option to duplicate it in File Explorer.

"Use my windows user account" is not available on the lock screen to connect to Wi-Fi.

NetJoinLegacyAccountReuse Registry key removed. See this support page.

This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. Is not installed on systems that dual boot Windows and Linux. Older Linux versions may not boot after the update is installed.

Windows 11 version 24H2

Support page: KB5041571

Updates and improvements:

Fixed the BitLocker recovery screen issue.

"Use my windows user account" is not available on the lock screen to connect to Wi-Fi.

NetJoinLegacyAccountReuse Registry key removed. See this support page.

This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. Is not installed on systems that dual boot Windows and Linux. Older Linux versions may not boot after the update is installed.

Windows Security updates

Delayed. Will post once published by Microsoft.

Non-Security updates

Known Issues

Windows 10 version 22H2

(OLD) Description: After installation of the update, users may be unable to change their account profile picture.

Workaround: none available at the time.

(FIXED) Description: Devices that use Microsoft Connected Cache (MCC) may download updates or apps from the public Internet instead, if they use DHCP Option 235 and have a recent update installed.

Workaround: Configure Microsoft Connected Cache endpoint in DOCacheHost policy as indicated in Cache hostname. Additionally, DOCacheHostSourcehas to be set to 1or removed as indicated in Cache hostname source. By default, the DOCacheHost and DOCacheHostSource policies have no value.

Windows 11 version 22H2 and 23H2

(OLD) Description: Enterprise customers may face issues when upgrading from a Windows Pro license to a valid Windows Enterprise subscription.

Workaround: none, Microsoft is investigating.

Windows 11 version 24H2

(NEW) Players on ARM devices may not be able to play Roblox via the Microsoft STore.

Workaround: download and play the title directly from the developer website.

Security advisories and updates

ADV 990001 -- Latest Servicing Stack Updates

Microsoft Office Updates

You find Office update information here.

How to download and install the August 2024 security updates

Security updates are installed automatically on most home Windows devices. This does not happen immediately though. Administrators may force updates right after they are released. This is done in the following way:

Select Start, type Windows Update and load the Windows Update item that is displayed.

Select check for updates to run a manual check for updates.

Windows Update should display the security update and start to download it.

Note: we recommend that you create a full system backup before installing any Windows update. This gives you another restoration option should things go wrong. The free Paragon Backup is a good choice, but there are others.

Direct update downloads

Below are resource pages with direct download links, if you prefer to download the updates to install them manually.

Windows 10 version 22H2

KB5041580 -- 2024-8 Cumulative Update for Windows 10 Version 21H2

Windows 11 version 22H2

KB5041585 -- 2024-8 Cumulative Update for Windows 11 version 22H2

Windows 11 version 23H2

KB5041585 -- 2024-8 Cumulative Update for Windows 11 version 23H2

Windows 11 version 24H2

KB5041571 -- 2024-8 Cumulative Update for Windows 11 version 24H2

Additional resources

August 2024 Security Updates release notes

List of software updates for Microsoft products

List of the latest Windows Updates and Services Packs

Security Updates Guide

Microsoft Update Catalog site

Our in-depth Windows update guide

How to install optional updates on Windows 10

Windows 11 Update History

Windows 10 Update History

Thank you for being a Ghacks reader. The post The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed appeared first on gHacks Technology News.

read more...

Aditya_Roy · Aug 13, 2024

BitLocker Recovery Issues

Hi,

Thank you for writing to Microsoft Community Forums.

We understand your concern as you are getting BitLocker recovery key prompt, every time you turned on the laptop. We appreciate your effort in troubleshooting the issue.

Ideally, in Windows 10 BitLocker doesn’t come by default. It could be possible that the BitLocker got enabled during some updates, either Windows update or PC manufacturer update.

As you have mentioned that you are forced to input the BitLocker recovery key, which is incredibly a tedious process.

Meanwhile, we would suggest you to disable the secure boot from the BIOS and check if you are able to bypass the BitLocker. Please refer the steps in this article:

Disabling Secure Boot

Regards,

Aditya Roy

Microsoft Community – Moderator

Brink · Aug 13, 2024

KB5012170: Security update for Secure Boot DBX: August 9, 2022

KB5012170: Security update for Secure Boot DBX: August 9, 2022 Applies to This security update applies only to the following Windows versions:

Windows Server 2012

Windows 8.1 and Windows Server 2012 R2

Windows 10, version 1507

Windows 10, version 1607 and Windows Server 2016

Windows 10, version 1809 and Windows Server 2019

Windows 10, version 20H2

Windows 10, version 21H1

Windows 10, version 21H2

Windows Server 2022

Windows 11, version 21H2 (original release)

Azure Stack HCI, version 1809

Azure Stack Data Box, version 1809 (ASDB)

Summary This security update makes improvements to Secure Boot DBX for the supported Windows versions listed in the "Applies to" section. Key changes include the following:

Windows devices that has Unified Extensible Firmware Interface (UEFI) based firmware can run with Secure Boot enabled. The Secure Boot Forbidden Signature Database (DBX) prevents UEFI modules from loading. This update adds modules to the DBX. A security feature bypass vulnerability exists in secure boot. An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software. This security update addresses the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX.

To learn more about this security vulnerability, see the following advisory:

ADV200011 | Microsoft Guidance for Addressing Security Feature Bypass in GRUB

For additional information about this security vulnerability, see the following resources:

CVE-2022-34301 | Eurosoft Boot Loader Bypass

CVE-2022-34302 | New Horizon Data Systems Inc Boot Loader Bypass

CVE-2022-34303 | Crypto Pro Boot Loader Bypass

Known issues [table][tr][td]Issue[/td] [td]Next step[/td] [/tr] [tr][td]Some original equipment manufacturer (OEM) firmware might not allow for the installation of this update.[/td] [td]To resolve this issue, contact your firmware OEM.[/td] [/tr] [tr][td]If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the update failing to install. To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions.[/td] [td]To workaround this issue, do one of the following before you deploy this update:

On a device that does not have Credential Gard enabled, run following command from an Administrator command prompt to suspend BitLocker for 1 restart cycle: Manage-bde –Protectors –Disable C: -RebootCount 1 Then, deploy the update and restart the device to resume the BitLocker protection.

On a device that has Credential Guard enabled, run the following command from an Administrator command prompt to suspend BitLocker for 2 restart cycles: Manage-bde –Protectors –Disable C: -RebootCount 3 Then, deploy the update and restart the device to resume the BitLocker protection.

[/td] [/tr] [tr][td]When attempting to install this update, it might fail to install, and you might receive Error 0x800f0922. Note This issue only affects this security update for Secure Boot DBX (KB5012170) and does not affect the latest cumulative security updates, monthly rollups, or security-only updates released on August 9, 2022.[/td] [td]This issue can be mitigated on some devices by updating the UEFI bios to the latest version before attempting to install this update. We are presently investigating and will provide an update in an upcoming release.[/td] [/tr] [tr][td]Some devices might enter BitLocker Recovery on the first or second restart after attempting to install this update on Windows 11.[/td] [td]If your device is prompting for a BitLocker Recovery key, you will need to supply it to start Windows. For more information, see Finding your BitLocker recovery key in Windows. If you have not installed this update and have BitLocker enabled on your device, follow the instructions below to temporarily suspend BitLocker before installing. If you have installed this update and have not yet restarted your device or have only restarted your device once, temporarily suspend BitLocker by using the instructions below. IMPORTANT: If you have restarted your device two times or more after installing this update, your device is not affected by this issue. To temporarily suspend BitLocker, or to avoid a BitLocker recovery when deploying this update, follow these steps:

Run the following command from an Administrator command prompt: Manage-bde -protectors -disable %systemdrive% -rebootcount 2

Install this update, if not already installed.

Restart the device.

Then, restart the device a second time.

BitLocker should automatically be enabled after two restarts. If you want to manually resume BitLocker to verify that it is enabled, use the following command: Manage-bde -protectors -Enable %systemdrive%

Status: We are working on a resolution and will provide an update in an upcoming release.[/td] [/tr] [/table]
How to get this update [table][tr]Release Channel Available Next Step [/tr] [tr][td]Windows Update or Microsoft Update[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update.[/td] [/tr] [tr][td]Windows Update for Business[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies.[/td] [/tr] [tr][td]Microsoft Update Catalog[/td] [td]Yes[/td] [td]To get the standalone package for this update, go to the Microsoft Update Catalog website.[/td] [/tr] [tr][td]Windows Server Update Services (WSUS)[/td] [td]Yes[/td] [td]This update will automatically synchronize with WSUS if you configure Products and Classifications as follows: Product: Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, version 1903 and later, Windows 11, Azure Stack HCI, Azure Data Box Classification: Security Updates[/td] [/tr] [/table]
Prerequisites Make sure you have the lastest servicing stack update (SSU) installed. For information about the latest SSU for your operating system, see ADV990001 | Latest Servicing Stack Updates. Restart information Your device does not have to restart when you apply this update. If you have Windows Defender Credential Guard (Virtual Secure Mode) enabled, your device might request a restart. Update replacement information This update replaces previously released update KB4535680. File information The English (United States) version of this security update installs files that have the attributes that are listed in the following tables.
Click to expand...

Read more: https://support.microsoft.com/en-us/...8-c42bd211bb15

NICK ADSL UK · Aug 13, 2024

Microsoft January 2024 Security Updates

January 2024 Security Updates This release consists of the following 48 Microsoft CVEs: Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations? SQL Server CVE-2024-0056 .NET and Visual Studio CVE-2024-0057 Windows Scripting CVE-2024-20652 Windows Common Log File System Driver CVE-2024-20653 Windows ODBC Driver CVE-2024-20654 Windows Online Certificate Status Protocol (OCSP) SnapIn CVE-2024-20655 Visual Studio CVE-2024-20656 Windows Group Policy CVE-2024-20657 Microsoft Virtual Hard Drive CVE-2024-20658 Windows Message Queuing CVE-2024-20660 Windows Message Queuing CVE-2024-20661 Windows Online Certificate Status Protocol (OCSP) SnapIn CVE-2024-20662 Windows Message Queuing CVE-2024-20663 Windows Message Queuing CVE-2024-20664 Windows BitLocker CVE-2024-20666 .NET Core & Visual Studio CVE-2024-20672 Windows Authentication Methods CVE-2024-20674 Azure Storage Mover CVE-2024-20676 Microsoft Office CVE-2024-20677 Windows Message Queuing CVE-2024-20680 Windows Subsystem for Linux CVE-2024-20681 Windows Cryptographic Services CVE-2024-20682 Windows Win32K CVE-2024-20683 Windows Win32 Kernel Subsystem CVE-2024-20686 Windows AllJoyn API CVE-2024-20687 Windows Nearby Sharing CVE-2024-20690 Windows Themes CVE-2024-20691 Windows Local Security Authority Subsystem Service (LSASS) CVE-2024-20692 Windows Collaborative Translation Framework CVE-2024-20694 Windows Libarchive CVE-2024-20696 Windows Libarchive CVE-2024-20697 Windows Kernel CVE-2024-20698 Windows Hyper-V CVE-2024-20699 Windows Hyper-V CVE-2024-20700 Unified Extensible Firmware Interface CVE-2024-21305 Microsoft Bluetooth Driver CVE-2024-21306 Remote Desktop Client CVE-2024-21307 Windows Kernel-Mode Drivers CVE-2024-21309 Windows Cloud Files Mini Filter Driver CVE-2024-21310 Windows Cryptographic Services CVE-2024-21311 .NET Framework CVE-2024-21312 Windows TCP/IP CVE-2024-21313 Windows Message Queuing CVE-2024-21314 Windows Server Key Distribution Service CVE-2024-21316 Microsoft Office SharePoint CVE-2024-21318 Microsoft Identity Services CVE-2024-21319 Windows Themes CVE-2024-21320 Microsoft Devices CVE-2024-21325 We are republishing 5 non-Microsoft CVEs: CNA Tag CVE FAQs? Workarounds? Mitigations? MITRE Corporation SQLite CVE-2022-35737 Chrome Microsoft Edge (Chromium-based) CVE-2024-0222 Chrome Microsoft Edge (Chromium-based) CVE-2024-0223 Chrome Microsoft Edge (Chromium-based) CVE-2024-0224 Chrome Microsoft Edge (Chromium-based) CVE-2024-0225 Security Update Guide Blog Posts Date Blog Post January 11, 2022 Coming Soon: New Security Update Guide Notification System February 9, 2021 Continuing to Listen: Good News about the Security Update Guide API January 13, 2021 Security Update Guide Supports CVEs Assigned by Industry Partners December 8, 2020 Security Update Guide: Let’s keep the conversation going November 9, 2020 Vulnerability Descriptions in the New Version of the Security Update Guide Relevant Resources

The new Hotpatching feature is now generally available. Please see Hotpatching feature for Windows Server Azure Edition virtual machines (VMs) for more information.

Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog. For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

Microsoft is improving Windows Release Notes. For more information, please see What's next for Windows release notes.

A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.

In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.

Customers running Windows 7, Windows Server 2008 R2, or Windows Server 2008 need to purchase the Extended Security Update to continue receiving security updates. See 4522133 for more information.

Known Issues You can see these in more detail from the Deployments tab by selecting Known Issues column in the Edit Columns panel. For more information about Windows Known Issues, please see Windows message center (links to currently-supported versions of Windows are in the left pane). KB Article Applies To nstalls KB Article Title 5034121 Windows 11, version 21H2 5034122 Windows 10, version 21H2, Windows 10, version 22H2 5034123 Windows 11, version 22H2, Windows 11, version 23H2 5034127 Windows 10, version 1809, Windows Server 2019 5034167 Windows Server 2008 R2 (Security-only update) 5034169 Windows Server 2008 R2 (Monthly Rollup) 5034173 Windows Server 2008 (Monthly Rollup) 5034176 Windows Server 2008 (Security-only update) Released: Jan 9, 2024 January 2024 Security Updates - Release Notes - Security Update Guide - Microsoft

Windows 10: The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed

The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed

The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed

The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed

The Windows Security Updates of August 2024 are now available - BitLocker Recovery issue fixed - Similar Threads - Security Updates August

August 2024 update issue

August 2024 update issue

August 2024 update disapeared

August 2024 update disapeared

Cumulative updates for Windows - August 2024

microsoft August 2024 Security Updates

microsoft August 2024 Security Updates

The Windows Security Updates of July 2024 are now available

The Windows Security Updates of June 2024 are now available