Each Hyper-V VM has a worker process, vmwp.exe, in the parent partition that services the guest's synthetic devices (storage, video, input, and others) through the virtualization service providers. The worker process parses the device requests and data the guest sends over VMBus, so a memory-corruption flaw runs code in vmwp.exe, which is then escalated to SYSTEM on the host.
Synthetic-device escape surface:
- Synthetic storage, video, and input request handling in vmwp.exe
- The virtualization service provider (VSP) interfaces
Exploitation notes#
- The worker process runs per VM with reduced privileges, so a bug yields worker-process code that is chained to SYSTEM; it is a step less direct than a Virtual switch kernel bug.
- Which devices are reachable depends on the guest's configured synthetic hardware.
- The transport beneath these devices is VMBus.