CVE-2023-36718: Windows 10 1507 vTPM RCE Vulnerability

CVE-2023-36718 Overview

CVE-2023-36718 is a remote code execution vulnerability in the Microsoft Virtual Trusted Platform Module (vTPM) component used by Hyper-V guest virtual machines. Despite the "remote" classification in the title, the CVSS vector specifies a local attack vector (AV:L) with high attack complexity and low privileges required. An authenticated attacker inside a guest VM can trigger code execution that crosses the security boundary into the host, indicated by the changed scope (S:C). Microsoft mapped the issue to CWE-94 (Improper Control of Generation of Code). The flaw affects supported builds of Windows 10, Windows 11, and Windows Server 2016 through 2022.

Critical Impact
Successful exploitation breaks the Hyper-V guest-to-host isolation boundary, allowing code execution with high impact to confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2)
Microsoft Windows Server 2016, 2019, and 2022

Discovery Timeline

2023-10-10 - CVE-2023-36718 published to NVD as part of Microsoft's October 2023 Patch Tuesday
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2023-36718

Vulnerability Analysis

The Virtual Trusted Platform Module is a software implementation of the TPM 2.0 specification that Hyper-V exposes to guest virtual machines. The vTPM handles cryptographic operations, key storage, attestation, and measured boot for the guest. Because the vTPM emulator executes inside a privileged host worker process, any parsing or state-handling flaw in command processing can cross the VM isolation boundary.

The issue is classified as [CWE-94] Improper Control of Generation of Code. Microsoft characterizes the outcome as remote code execution, but the CVSS metrics indicate the attacker must already have local, low-privileged access inside a guest VM. The scope change (S:C) confirms that the impact extends beyond the vulnerable component into the host.

Root Cause

The root cause lies in how the vTPM component generates or interprets data structures from guest-supplied TPM command buffers. Improper validation during command parsing allows attacker-controlled input to influence code generation or execution flow within the host-side vTPM handler.

Attack Vector

Exploitation requires an authenticated user inside a Hyper-V guest VM with a virtual TPM attached. The attacker issues crafted TPM 2.0 commands through the standard guest interface. The high attack complexity (AC:H) suggests that successful exploitation depends on specific timing, memory state, or configuration conditions. No user interaction on the host is required.

Microsoft has not published technical exploitation details. Refer to the Microsoft Security Update Guide for CVE-2023-36718 for vendor guidance.

Detection Methods for CVE-2023-36718

Indicators of Compromise

Unexpected crashes or restarts of the vmwp.exe Hyper-V worker process associated with a specific guest VM
Anomalous TPM command sequences logged by the Microsoft-Windows-Hyper-V-Worker event channel
New host-level processes spawned in temporal proximity to guest TPM activity

Detection Strategies

Monitor Hyper-V worker process telemetry for abnormal terminations or memory anomalies on hosts running guests with vTPM enabled
Compare installed Windows update KB numbers against the October 2023 Microsoft security update baseline to identify unpatched hosts
Alert on guest VMs issuing high volumes of malformed TPM commands at the hypervisor boundary

Monitoring Recommendations

Forward Hyper-V operational and admin event logs to a centralized SIEM for correlation across hosts
Track parent-child process relationships from vmwp.exe to identify unexpected host code execution
Audit which guest VMs have vTPM enabled and restrict the population to those that require it

How to Mitigate CVE-2023-36718

Immediate Actions Required

Apply the October 2023 Microsoft security updates to all Hyper-V hosts running affected Windows versions
Inventory all guest VMs with vTPM enabled and prioritize patching the hosts that run them
Restrict guest VM access to trusted, authenticated users only, since exploitation requires local guest access

Patch Information

Microsoft released the fix as part of the October 2023 Patch Tuesday cycle. Administrators should consult the Microsoft Security Update Guide for CVE-2023-36718 to identify the correct KB article for each affected Windows build and install it on Hyper-V hosts.

Workarounds

Disable vTPM on guest VMs that do not require it, reducing the host-side attack surface
Limit interactive and remote login access on guest VMs to reduce the population of users who could attempt exploitation
Apply Hyper-V host hardening guidance, including running hosts on Server Core and segregating management networks

bash

# Identify guest VMs with a virtual TPM attached (run on the Hyper-V host)
Get-VM | ForEach-Object {
    [PSCustomObject]@{
        VMName  = $_.Name
        TpmEnabled = (Get-VMSecurity -VM $_).TpmEnabled
    }
} | Where-Object { $_.TpmEnabled -eq $true }

# Disable vTPM on a specific VM that does not require it
Stop-VM -Name "ExampleGuest" -Force
Set-VMSecurity -VMName "ExampleGuest" -TpmEnabled $false