Researchers Publish Details on Recent Critical Hyper-V Vulnerability

Security researchers at Guardicore Labs are sharing details of a critical vulnerability in Hyper-V that Microsoft patched in May 2021.

Tracked as CVE-2021-28476 with a CVSS score of 9.9, the security vulnerability impacts Hyper-V’s virtual network switch driver (vmswitch.sys) and could be exploited to achieve remote code execution or cause a denial of service condition.

Hyper-V is a native hypervisor that provides virtualization capabilities for both desktop and cloud systems, and which Microsoft uses as the underlying virtualization technology for Azure.

The security issue that Guardicore Labs (in collaboration with SafeBreach Labs) discovered was likely in production for more than a year, as it first appeared in a vmswitch build in August 2019. The vulnerability affects Windows 7, 8.1 and 10 and Windows Server 2008, 2012, 2016 and 2019.

An attacker with an Azure virtual machine could exploit the security bug by sending a crafted packet to the Hyper-V host. This could have resulted in the attacker running code on the Hyper-V host and potentially taking down entire regions of the cloud.

[ Related: Microsoft Patches 3 Under-Attack Windows Zero-Days ]

An attacker capable of exploiting the vulnerability to achieve remote code execution – a more complex exploitation chain – could take control over the host and the VMs running on it, thus having access to sensitive information and being able to run malicious payloads or perform other nefarious operations, the security researchers say.

The issue exists because, when processing OID requests, vmswitch doesn’t validate the value of the request, and may dereference an invalid pointer.

Guardicore Labs says that there are two exploitation scenarios, one where an invalid pointer leads to the Hyper-V host crashing, and another where the host’s kernel would read from a memory-mapped device register, thus leading to code execution.

“What made this vulnerability so lethal is the combination of a hypervisor bug – an arbitrary pointer dereference – with a design flaw allowing a too-permissive communication channel between the guest and the host,” the researchers added.

Related: Microsoft Patches 3 Under-Attack Windows Zero-Days

Related: ‘Siloscape’ Malware Targets Windows Server Containers