Kvm Guest Drivers Windows
Monthly
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.