Hyper-V guest-to-host escapes that have been published cluster in the root-partition components that parse guest-controlled data. Knowing the pattern lets an attacker match a target Windows/Hyper-V build to the component most likely to carry a usable bug:
- vmswitch and netvsp: the networking datapath and synthetic network VSP, parsing RNDIS and buffer descriptors in the root-partition kernel, a repeated and high-impact cluster.
- Synthetic video VSP (synthvid): mode and region descriptor parsing with guest-controlled geometry.
- Synthetic storage VSP (storvsp): SCSI request and transfer-descriptor handling.
- VMBus transport and GPADL: ring-packet and guest-memory-registration handling beneath the devices.
- Hypercalls: the hypervisor's hypercall interface, where parameter handling flaws affect the hypervisor itself rather than the root partition.
Using the pattern#
# fingerprint the exact build (decides which component is vulnerable)
[System.Environment]::OSVersion.Version; (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
# from the guest, confirm which synthetic devices/paths are present
Get-PnpDevice | ? InstanceId -like 'VMBUS*'
Fingerprint the build, confirm which synthetic devices and paths the guest exposes, and match the build to the MSRC advisory for that component. Escapes are build-specific and generally require an information leak paired with the memory-corruption primitive; vmswitch bugs are kernel-level in the root partition and among the highest impact.
Exploitation notes#
- The networking path (vmswitch/netvsp) is the standout recurring cluster and lands in the root-partition kernel; treat it as the first place to look on a networked guest.
- Hypercall-interface bugs are distinct: they can affect the hypervisor directly, a different and severe class from root-partition corruption.
- The mechanisms are on the per-surface pages under Guest-to-host escape; this page is the mapping aid, not a PoC source.