Skip to content
OpenAdvisories
Critical MSRC-CVE-2022-30163 1 CVE

Windows Hyper-V Remote Code Execution Vulnerability

Published Jun 14, 2022 · Updated Jun 14, 2022

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
In this case, a successful attack could be performed from a low privilege Hyper-V guest. The attacker could traverse the guest's security boundary to execute code on the Hyper-V host execution environment.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

How could an attacker exploit this vulnerability?
To exploit this vulnerability, an attacker could run a specially crafted application on a Hyper-V guest that could cause the Hyper-V host operating system to execute arbitrary code.

Security updates
10.0.17763.3046 — https://support.microsoft.com/help/5014692
10.0.19043.1766 — https://support.microsoft.com/help/5014699
10.0.20348.770 — https://support.microsoft.com/help/5014678
10.0.20348.770 — https://support.microsoft.com/help/5014677
10.0.22000.739 — https://support.microsoft.com/help/5014697
10.0.10240.19325 — https://support.microsoft.com/help/5014710
10.0.14393.5192 — https://support.microsoft.com/help/5014702
6.1.7601.25984 — https://support.microsoft.com/help/5014748
6.1.7601.25984 — https://support.microsoft.com/help/5014742
6.3.9600.20402 — https://support.microsoft.com/help/5014738
6.3.9600.20402 — https://support.microsoft.com/help/5014746
6.2.9200.23736 — https://support.microsoft.com/help/5014747
6.2.9200.23736 — https://support.microsoft.com/help/5014741

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References