Hyper-V

Hyper-V is Microsoft's type-1 hypervisor: a thin hypervisor runs beneath a privileged root partition, and guest partitions reach host services over VMBus, a ring-buffer channel transport. Each VM has a worker process (vmwp.exe) in the root partition, and the synthetic devices a guest uses are serviced by Virtualization Service Providers (VSPs) there. The guest-to-host escape surface is that VMBus and synthetic-device handling in the root partition; alongside it are the management plane (WMI and PowerShell cmdlets) and the on-disk artefacts, checkpoints and VHD/VHDX virtual disks, that hold guest data.

# from a Windows guest: the synthetic devices and VMBus
Get-PnpDevice | Where-Object { $_.InstanceId -like 'VMBUS*' }
# from the host: VMs, their worker processes, and management
Get-VM; Get-Process vmwp

Subtopics#

• Guest-to-host escape: VMBus and synthetic-device breakout to the root partition.
• Checkpoint and VHD theft: stealing virtual disks and saved state.
• Host access and shell: execution on the Hyper-V host.
• Management plane and WMI abuse: the WMI and PowerShell control surface.
• Known escape exploits: the recurring VMBus and VSP bugs.

References#

• Microsoft: Hyper-V architecture
• MSRC: Hyper-V bug bounty and research
• Microsoft security update guide