Guest-to-host escape

A Hyper-V guest escapes by corrupting the root partition code that services its requests: the VMBus channel transport and the synthetic devices (storage, network, video, HID) backed by Virtualization Service Providers, and the emulated devices and virtual switch in the worker process. A memory-safety flaw there executes in the root partition, which controls every VM.

1 min di letturaaggiornato il 7 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

A Hyper-V guest is isolated by the hypervisor, so it cannot touch the host directly; it reaches host functionality through VMBus, over which synthetic devices talk to Virtualization Service Providers (VSPs) in the root partition, and through the worker process (vmwp.exe) that handles emulated devices and the virtual switch. Escaping means making one of those root-partition components mishandle guest-controlled data: a VMBus packet, a synthetic-device request, or an emulated-device access. Code execution lands in the root partition or the worker process, which is effectively host control because the root partition administers all guests.

powershell
# the VMBus devices and channels visible from the guest
Get-PnpDevice | Where-Object InstanceId -like 'VMBUS*'
# synthetic storage/net/video/HID are the high-level targets; the transport is VMBus

Subtopics#

  • VMBus: the ring-buffer channel transport between guest and root partition.
  • Synthetic devices: the VSP-backed storage, network, video, and HID devices.
  • Virtual switch: the networking datapath in the root partition.

References#

PrecedenteHyper-VSuccessiva Virtual switch