Public Hyper-V breakouts cluster around a few components. The virtual switch (vmswitch) has produced host kernel code execution from guest network traffic. The VM worker process has been reached through synthetic storage and video device handling. The now-removed RemoteFX vGPU path was a repeated escape surface. Each needs the relevant device to be attached to the guest.
Recurring Hyper-V escape surfaces:
- vmswitch: guest network frames parsed in the host kernel
- vmwp.exe: synthetic device (storage, video) data parsed in the host
- RemoteFX vGPU: 3D data path (removed in current Windows)
- VMBus ring-buffer handling for synthetic devices
Exploitation notes#
- Whether a surface is reachable depends on the guest's configuration: a guest without a synthetic video adapter or vGPU cannot reach those code paths.
- vmswitch bugs are the most dangerous class, since they are reachable from any guest with a virtual NIC and land in the host kernel.
- The underlying technique is memory corruption in host-side parsing; see Guest to host escape for the surface map.