The July Windows 10 2004 KB4568831 has caused havoc with Lenovo Thinkpads. Users have found that they would experience a system crash with the error “SYSTEM_THREAD_EXCEPTION_NOT_HANDLED” with stop code “0xc0000005 Access Denied”.
Microsoft has now acknowledged the error on Lenovo Thinkpad devices and has offered a work around as a result.
Lenovo has also advised that errors, crashes and other bugs could arise on Thinkpad models from 2019 and 2020 with Virtualization enabled.
In a recently released support bulletin, Microsoft stated that the KB4568831 updates, and those that followed, restrict how certain regions of memory known as PCI Device Configuration Space can be accessed by processes.
“If a process attempts to access a PCI Device Configuration Space in an unsupported manner, it will cause Windows 10 to crash with a Stop error.”
“Windows devices that receive the July 31, 2020—KB4568831 (OS Build 19041.423) Preview or later updates restrict how processes can access peripheral component interconnect (PCI) device configuration space if a Secure Devices (SDEV) ACPI table is present and Virtualization-based Security (VBS) is running. Processes that have to access PCI device configuration space must use officially supported mechanisms.”
“The SDEV table defines secure hardware devices in ACPI. VBS is enabled on a system if security features that use virtualization are enabled. Some examples of these features are Hypervisor Code Integrity or Windows Defender Credential Guard.”
“The new restrictions are designed to prevent malicious processes from modifying the configuration space of secure devices. Device drivers or other system processes must not try to manipulate the configuration space of any PCI devices, except by using the Microsoft-provided bus interfaces or IRPs. If a process tries to access PCI configuration space in an unsupported manner (such as by parsing MCFG table and mapping configuration space to virtual memory), Windows denies access to the process and generates a Stop error,”
Microsoft has stated that they are currently working on a fix with the manufacturer, Lenovo to prevent these crashes in later releases of Windows 10.
Microsoft has suggested a temporary workaround by disabling the ‘Enhanced Windows Biometric Security’ security feature in the Lenovo UEFI configuration.
“To temporarily mitigate this problem, edit the device UEFI configuration (in the Security > Virtualization section) to disable Enhanced Windows Biometric Security. This change disables the restrictions that are enabled by the SDEV table and VBS,” Microsoft stated.
Microsoft nor Lenovo have confirmed when a more permanent fix will be ready, however it is likely updates from Lenovo to software, firmware and driver will be required in the first instance.
