Secure Boot Downgrade Attack: Breaking TPM-Only BitLocker via CVE-2025-48804

A significant security flaw has surfaced, demonstrating that the perceived “fortress” of Windows 11 BitLocker encryption can be breached in under five minutes. This proof-of-concept (PoC) exploit, colloquially known as the “BitUnlocker” attack, utilizes a sophisticated physical downgrade technique to bypass disk encryption on target machines.

At the heart of this exploit lies CVE-2025-48804. Originally identified by the Microsoft STORM team in July 2025, the vulnerability highlights a critical architectural weakness in the interplay between Secure Boot protocols and legacy cryptographic certificates.

The Root Cause: The PCA 2011 Certificate Dilemma

While Microsoft has released patches to address the core logic of this vulnerability, a massive “security debt” remains. The issue is not necessarily a failure of the new code, but the continued presence of the Microsoft Windows PCA 2011 certificate within the Secure Boot database.

From a technical standpoint, the industry faces a catch-22. Revoking the PCA 2011 certificate en masse would be a catastrophic event for global enterprise networks, potentially rendering millions of legacy boot sequences unbootable.

Consequently, this older, vulnerable certificate remains widely trusted. This allows an attacker to load an outdated, vulnerable boot manager that still carries a valid signature, thereby bypassing the integrity checks that Secure Boot is intended to enforce.

Technical Execution of the BitUnlocker Exploit

To successfully execute a BitUnlocker attack, an adversary requires physical access to the hardware. The attack targets systems utilizing a TPM-only BitLocker configuration—a common setup designed for user convenience that lacks a secondary layer of pre-boot authentication.

The attack vector is straightforward: the adversary boots the machine via a specialized USB flash drive or through a network-based PXE boot. Security researcher Cassius Garat has documented the exploit, which centers on the manipulation of the Boot Configuration Data (BCD) file.

The technical workflow follows these steps:

1. Redirection: The attacker modifies the BCD file to redirect the Windows Recovery Environment (WinRE) input to a modified System Deployment Image (SDI).
2. The Double-Load Trick: During the boot sequence, the system validates the older PCA 2011 signed boot manager. This manager performs a legitimate check on the first Windows Imaging Format (WIM) file, but simultaneously initializes a second, attacker-controlled WIM file hidden within the modified SDI.
3. TPM Unsealing: Because the legacy certificate is still recognized as “trusted,” the Trusted Platform Module (TPM) observes that the Platform Configuration Registers (specifically PCR 7 and 11) appear valid within the context of the legacy boot path. As a result, the TPM releases the BitLocker encryption keys automatically.
4. Access: A compromised WinRE image executes a terminal command, presenting the attacker with a fully decrypted, mounted operating system volume in minutes.

The following commands illustrate how an attacker diverts the boot sequence within a recovery prompt:

// Export the current BCD to prevent permanent bricking during testing
bcdedit /export BCD_modded

// Point the default boot loader to a non-existent path to force redirection
bcdedit /store BCD_modded /set {default} path \WINDOWS\system32\winload_DOESNOTEXIST.efi

// Locate the "Windows Recovery" GUID and remap the SDI device and path
bcdedit /store BCD_modded /enum all
:: [Identify GUID]
bcdedit /store BCD_modded /set {GUID} ramdisksdidevice boot
bcdedit /store BCD_modded /set {GUID} ramdisksdipath \sdi\boot_patched.sdi

Vulnerability Summary

Mitigation Strategies for System Administrators

Standard Windows Update cycles are insufficient to fully neutralize this threat due to the certificate revocation issue. Administrators should implement the following defense-in-depth measures:

• Implement TPM + PIN Authentication: This is the most effective defense. By requiring a pre-boot PIN, the TPM will refuse to unseal the encryption keys unless the correct user input is provided, regardless of whether the boot path appears “valid” to the hardware.
• Transition to Windows UEFI CA 2023: Organizations must prioritize migrating boot managers to the newer CA 2023 standard. Following this migration, the PCA 2011 certificate must be manually revoked via the DBX (Forbidden Signature Database). Refer to Microsoft KB5025885 for deployment guidance.
• Hardening PCR Policies: Avoid relying solely on default PCR settings. By configuring the system to include PCR 0, 2, or 4 in the BitLocker sealing policy, any modification to the bootloader or the SDI file will alter the platform measurements, causing the TPM to fail the integrity check and withhold the keys.