Hyper-V attack surface

TL;DR: From a guest you reach the host via VMBus channels, virtualised devices (vmswitch, vmscsi, vGPU), Integration Components, and hypercalls — each is a distinct parser/handler running in root partition with privileged code paths.

What it is

A starting map for guest→host escapes on Hyper-V. The hypervisor itself (hvix64.exe) is small and hard; most published guest-to-host CVEs target the root-partition components that service guest requests: the virtualisation stack (vmswitch.sys, vmsp.exe, VID.sys, vmcompute.exe) and Integration Services running in the guest with privileged channels to the host.

Preconditions / where it applies

Researcher with a Windows host running Hyper-V (Server 2019+/Windows 10/11 Pro) and a Windows or Linux guest.
Tooling: livekd -hv, WinDbg with hyper-v support, public symbols, the Hyper-V Virtualization Stack source signatures.
Kernel-level access inside the guest (you control IRPs, device requests).

Technique

Attack-surface inventory:

VMBus. The synthetic bus connects guest and host. Each device exposes ring buffers (_VMRING) and channel IDs; messages are GPADL-mapped pages. Bugs in VMBus parsing (vmbusr.sys / vmbkmcl.sys) land in root partition kernel.
vmswitch.sys — virtual NIC; handles RNDIS, VLAN, IP-tag offloads. Historically rich (CVE-2018-0959, CVE-2022-21971 lineage).
vmscsi / storvsc — virtual storage; SCSI CDB parsing on the host.
vid.sys / Worker Process (vmwp.exe) — runs per VM in user mode (medium IL); ICs talk to it; bugs here are NT-level RCE in a host process.
vGPU / RemoteFX / GPU-PV — DXGKRNL exposes paravirtualised GPU; large attack surface, multiple CVEs.
Hypercalls. vmcall/vmmcall enter the hypervisor; the call number selects a handler. Mostly hardened, but feature additions (TLB flush, SynIC) have produced bugs.
Integration Components inside guest. ICs are signed Windows drivers (hv_*.sys for Linux); compromising one gives the attacker a privileged communication channel to host.

Reconnaissance moves:

Enumerate VMBus devices: Get-VMBusChannel | Format-Table.
Hook ring buffer descriptors in the guest to fuzz inbound/outbound messages.
Use hyperv-fuzz-style harnesses (Project Zero, MSRC blog posts) that intercept and mutate VMBus traffic.

Typical bug shape: size-confusion or missing length check in a host parser → controlled OOB write in vmswitch.sys pool → kernel primitive in root partition.

Detection and defence

Patch Tuesday for Hyper-V components (especially vmswitch.sys, vmbusr.sys, vid.sys); track CVEs labelled “Hyper-V Remote Code Execution / EoP.”
HVCI + Credential Guard inside the host harden the parent partition; Shielded VMs harden guest configuration.
Run untrusted workloads under nested isolation (Hyper-V Container / Windows Sandbox) to add another boundary.

References

Microsoft: Hyper-V architecture — component overview
Project Zero — Hyper-V series — research write-ups
MSRC Hyper-V bounty scope — current surface definition