BitPixie Windows Boot Manager Flaw Lets Hackers Escalate Privileges

BitPixie is a vulnerability nicknamed in Windows Boot Manager that allows attackers to bypass BitLocker drive encryption and escalate privileges, security researchers have revealed. The flaw stems from a weakness in the PXE soft reboot feature, which fails to properly clear the BitLocker VMK from system memory after reboot, affecting systems from 2005 to 2022.

According to Microsoft, a patch (KB5025885) released in May 2023 replaces the old certificate with the Windows UEFI CA 2023 certificate to block downgrade attacks, though older boot managers can still be exploited via downgrade paths.

Attackers load an older unpatched boot manager, search memory for BitLocker regions marked by the signature -FVE-FS-, extract a 32-byte master key, and bypass BitLocker to gain administrative access to the encrypted drive; the process can be performed with network-based PXE booting using a tailored BCD file.

Security researchers have demonstrated that BitPixie remains effective even on systems with BitLocker Pre-Boot Authentication and PIN protection, highlighting the need for immediate patching to maintain drive encryption integrity. Thomas Lambertz previously demonstrated a complete exploitation of this vulnerability at the 38C3 security conference. according to Microsoft