I have a twofold question, first when choosing between AES-CBC and AES-XTS which is more secure. From my reading XTS is more secure in some respects but not in others when compared to CBC. Second are both modes FIPS 140-2 approved? Related to that question if I am using BitLocker on a virtual machine volume with no TPM, only a password would that still be covered? I looked at the following but it didn't really give an answer.
According to Microsoft Bitlocker is FIPS 140-2 approved when used with AES-256 without the elephant diffuser enabled. The elephant diffuser is designed to prevent CBC bit-flipping attacks: rather than a bit flip affecting one bit in the subsequent block, it would affect more (50% on average, IIRC). NIST CSRC also lists both CBC and XTS modes as FIPS 140-2 approved, though it's not clear if this applies to all of Bitlocker.