Critical Microsoft Hyper-V bug could haunt orgs for a long time

guest · Jul 28, 2021

Critical Microsoft Hyper-V bug could haunt orgs for a long time
July 28, 2021
https://www.bleepingcomputer.com/ne...hyper-v-bug-could-haunt-orgs-for-a-long-time/

Technical details are now available for a vulnerability that affects Hyper-V, Microsoft's native hypervisor for creating virtual machines on Windows systems and in the Azure cloud computing environment.

Currently tracked as CVE-2021-28476, the security issue has a critical severity score of 9.9 out of 10. Exploiting it on unpatched machines can have a devastating impact as it allows crashing the host (denial of service) or execute arbitrary code on it.
Terminate VMs or take full control
The bug is in Hyper-V's network switch driver (vmswitch.sys) and affects Windows 10 and Windows Server 2012 through 2019. It emerged in a build from August 2019 and received a patch earlier this year in May.
Click to expand...

Public details about the flaw are scarce at the moment but in a blog post today, researchers Peleg Hadar of SafeBreach and Ophir Harpaz of Guardicore explain where the fault is and why it is exploitable. The two researchers found the bug together and disclosed it privately to Microsoft.

The flaw stems from the fact that Hyper-V’s virtual switch (vmswitch) does not validate the value of an OID (object identifier) request that is intended for a network adapter (external or connected to vmswitch).

“While processing OID requests, vmswitch traces their content for logging and debugging purposes; this also applies to OID_SWITCH_NIC_REQUEST. However, due to its encapsulated structure, vmswitch needs to have special handling of this request and dereference OidRequest to trace the inner request as well. The bug is that vmswitch never validates the value of OidRequest and can thus dereference an invalid pointer,” Harpaz explains
Click to expand...

Guardicore: Critical 9.9 Vulnerability In Hyper-V Allowed Attackers To Exploit Azure

Executive Summary

• Guardicore Labs, in collaboration with SafeBreach Labs, found a critical vulnerability in Hyper-V’s virtual network switch driver (vmswitch.sys).
• Hyper-V serves as the underlying virtualization technology for Azure – Microsoft’s public cloud.
• The vulnerability allows for both Remote Code Execution (RCE) and Denial-of-Service (DoS). Exploiting it allowed an attacker with an Azure virtual machine to take down whole regions of the cloud as well as run arbitrary code on the Hyper-V host.
• The vulnerability first appeared in a vmswitch build from August 2019, suggesting this bug might have been in production for over a year.
• In May 2021, Microsoft assigned the vulnerability CVE-2021-28476 with a CVSS score of 9.9 and released a patch for it.
• The vulnerability was found by Guardicore’s Ophir Harpaz and SafeBreach’s Peleg Hadar using an in-house developed fuzzer named hAFL1. They will elaborate on the fuzzer and their research process in a Black Hat USA 2021 talk.
Click to expand...

Log in or Sign up

Critical Microsoft Hyper-V bug could haunt orgs for a long time

guest Guest

Log in or Sign up

Critical Microsoft Hyper-V bug could haunt orgs for a long time

guest Guest

Useful Searches