• Windows ‘Downdate’ Attack Reverts Patched PCs to a Vulnerable State

Fully patched Windows 11 systems are vulnerable to sophisticated downgrade attacks, allowing adversaries to install custom rootkits, evade endpoint security, conceal malicious activity, and maintain persistence on compromised systems. This exploit leverages a Windows OS downgrade method, demonstrated by SafeBreach researcher Alon Leviev at Black Hat USA 2024, using a custom tool called Windows Downdate. Leviev’s tool shows how attackers with administrative access can manipulate the Windows Update process, reverting critical components—such as libraries, drivers, and even the OS kernel—to insecure, previously patched versions.

During his demonstration, Leviev downgraded key virtualization-based security (VBS) features like Secure Kernel and Credential Guard’s Isolated User Mode Process, exposing them to privilege escalation vulnerabilities that Microsoft had previously addressed. “I was able to make a fully patched Windows machine susceptible to past vulnerabilities, making ‘fully patched’ a meaningless term,” Leviev noted.

In response, Microsoft has addressed two specific vulnerabilities in Leviev’s attack chain (CVE-2024-21302 and CVE-2024-38202) but has not yet remedied the broader exploit path that allows attackers with admin-level access to downgrade OS components through the Windows Update process. Microsoft’s position on this vulnerability is that crossing from admin privileges to the kernel is not a security boundary, hence it is not addressed as a security vulnerability. “Microsoft has fixed every issue that crosses a defined security boundary,” Leviev explained, but the ability of an admin to gain kernel execution remains outside these definitions. On October 26, Leviev released a new version of the downgrade exploit, bypassing driver signature enforcement (DSE) to load unsigned drivers—an exploit Microsoft had previously mitigated with CVE-2024-21302. This exploit leverages “False File Immutability” (FFI), a flaw that researchers at Elastic Security recently identified as arising from incorrect assumptions about file immutability in Windows.

Using Windows Downdate, Leviev demonstrated how downgrading a specific module (CI.dll) reintroduces this vulnerability, enabling the attacker to load unsigned kernel drivers and deploy rootkits, even on systems with VBS enabled.

Windows’ failure to validate DLL version numbers when loading them allows attackers to leverage outdated files susceptible to exploitation. “If attackers can downgrade Windows Defender, they gain an advantage in executing malicious files that would normally be detected,” (Tim Peck).

Microsoft has since acknowledged these risks and is developing mitigations to prevent the exploitation of unpatched VBS files, although no release timeline has been provided. The company noted that blocking such a broad range of outdated files requires extensive testing to prevent compatibility issues.