Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine

Overview: Joe Bialek from Microsoft's Security Response Center (MSRC) Vulnerabilities & Mitigations team details the vulnerability analysis and weaponization of a virtual machine escape in Microsoft Hyper-V. Delivered at Black Hat, the presentation examines a critical flaw in Hyper-V's legacy IDE storage emulator. Bialek walks through the construction of out-of-bounds read and write primitives from the guest VM to the host worker process (`vmwp.exe`), demonstrating arbitrary code execution on Windows Server 2012 R2 and evaluating modern exploit mitigations on Windows 10 Redstone 3.

Key Topics: - Hyper-V partition architecture and the VM Worker Process (`vmwp.exe`) execution model - State machine vulnerability in the legacy IDE storage emulator (`write_data_port` / `read_data_port`) - Exploitation mechanics on Windows Server 2012 R2: heap layout, VRAM markers, and stack pivoting - Windows 10 Redstone 3 mitigations: CFG, ACG, CIG, and bottom-up allocator separation

Technical Details: Hyper-V enforces virtualization isolation using hardware-assisted extended page tables to separate guest partitions from the host root partition. Emulated legacy devices execute in user mode within the host VM Worker Process (`vmwp.exe`). When a guest executes x86 `IN` or `OUT` I/O port instructions targeting IDE ports 0x1F0–0x1F7, the hypervisor intercepts the operations and routes them through the host kernel to `vmwp.exe`. The vulnerability resides in the legacy IDE disk emulator state machine, specifically within the `write_data_port` and `read_data_port` functions managing the 64 KB `track_cache_buffer`.

The bug stems from improper bounds enforcement on the `drive_state_buffer_offset` variable. By issuing sequential I/O port writes, a guest attacker increments this 32-bit unsigned offset in 512-byte increments, allowing it to expand up to 4 GB. Combined with the 9-bit `current_byte` pointer (0–511), the attacker obtains relative 32-bit out-of-bounds read and write primitives relative to the `track_cache_buffer`. Because this buffer is allocated via `VirtualAlloc`—Windows' bottom-up allocator that allocates memory sequentially with 64 KB alignment—the process virtual address space exhibits highly predictable relative offsets.

On Windows Server 2012 R2, Bialek weaponized these primitives to achieve full host code execution. By writing distinct byte patterns into the guest VRAM buffer and scanning forward with the out-of-bounds read primitive, the exploit determined the exact distance between the track cache buffer and adjacent allocations. On Server 2012 R2, thread stacks were allocated within the bottom-up virtual memory pool. The exploit located the floppy device event listener thread stack, leaked base pointers for `ntdll.dll` and `kernel32.dll` to defeat ASLR, and overwrote the stack with a ROP chain. Because the floppy listener thread remained blocked waiting for events, Bialek discovered that restarting the guest VM triggered a hypervisor shutdown notification, causing the floppy thread stack to unwind, executing the ROP payload, and calling `WinExec` to launch `calc.exe` under the `vmwp.exe` service account.

On Windows 10 (1709 / Redstone 3), new exploit mitigations blocked this specific path. Thread stacks, TEBs, and PEBs were relocated away from bottom-up `VirtualAlloc` regions, preventing direct stack corruption. Furthermore, `vmwp.exe` enforced Arbitrary Code Guard (ACG, blocking unsigned executable memory), Code Integrity Guard (CIG), Child Process creation restrictions, and Control Flow Guard (CFG), requiring complex heap grooming in isolated target heaps and direct CFG bypass strategies.

Key Takeaways: Legacy device emulation constitutes a severe hypervisor attack surface, reinforcing the necessity of paravirtualized VMBus synthetic devices and the deprecation of legacy emulators in Generation 2 virtual machines. Modern platform exploit mitigations—including ACG, CIG, CFG, and the architectural separation of thread stacks from bottom-up memory allocators—dramatically constrain the weaponization of powerful read/write primitives. Hypervisor vendors must enforce strict state-machine validation and employ modern bounds-checking container abstractions (such as GSL `span`) across legacy C/C++ codebases.

(AI summary — Gemini Flash)