CVE-2024-20684 Overview
CVE-2024-20684 is a denial of service vulnerability in Microsoft Windows Hyper-V. An authenticated attacker with low privileges on a guest virtual machine can trigger a condition that disrupts availability on the Hyper-V host. Microsoft published the advisory on February 13, 2024, and the issue affects Windows 11 and Windows Server 2022 systems running the Hyper-V role. The flaw is categorized under [CWE-20] Improper Input Validation. Exploitation requires local access and does not require user interaction, but the scope is changed because a guest VM action impacts the host.
Critical Impact
A low-privileged attacker inside a Hyper-V guest can cause the host hypervisor to enter a denial of service state, disrupting all virtual machines running on that host.
Affected Products
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2022
- Microsoft Windows Server 2022 23H2 Edition
Discovery Timeline
- 2024-02-13 - CVE-2024-20684 published to NVD
- 2024-02-13 - Microsoft releases security update via Patch Tuesday
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-20684
Vulnerability Analysis
The vulnerability resides in the Windows Hyper-V virtualization stack. Hyper-V provides hardware-assisted virtualization by mediating guest VM access to host resources through the hypervisor and virtualization service providers (VSPs). The flaw allows a guest operating system to issue input that the Hyper-V host fails to validate properly, leading to a host-side availability impact.
The scope-changed nature of the issue indicates that an action performed within the security boundary of a guest VM affects components outside that boundary. A successful trigger does not disclose information or modify data, but it halts or destabilizes Hyper-V services on the host. All co-resident virtual machines lose availability when the host enters the failure state.
Root Cause
The root cause is improper input validation [CWE-20] in a Hyper-V component that processes data originating from guest virtual machines. The host-side handler does not adequately verify guest-supplied parameters before acting on them, allowing malformed or unexpected input to reach internal logic that cannot tolerate it. Microsoft has not published specific details about the affected component or interface.
Attack Vector
Exploitation requires the attacker to hold valid low-privileged credentials inside a guest VM hosted on a vulnerable Hyper-V server. The attacker then submits crafted input through a guest-to-host interface, such as a paravirtualized device channel, hypercall, or VMBus communication path. No user interaction on the host is required. The attack vector is local from the perspective of the guest, but the impact crosses the virtualization boundary to affect the host.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2024-20684 Advisory for vendor-specific guidance.
Detection Methods for CVE-2024-20684
Indicators of Compromise
- Unexpected Hyper-V host crashes, bugchecks, or hypervisor service restarts coinciding with guest VM activity.
- Multiple guest VMs on the same host transitioning to a paused, saved, or unresponsive state simultaneously.
- Hyper-V-Worker and Hyper-V-Hypervisor event log entries indicating abnormal VMBus or virtualization stack errors.
Detection Strategies
- Monitor the Microsoft-Windows-Hyper-V-Worker-Admin and Microsoft-Windows-Hyper-V-Hypervisor-Operational event logs for repeated errors originating from a specific guest VM.
- Correlate guest VM process activity with host availability events to identify guests that consistently precede host instability.
- Track Windows Update compliance across the Hyper-V fleet to identify hosts still missing the February 2024 security update.
Monitoring Recommendations
- Establish baselines for Hyper-V host uptime and worker process restarts, then alert on deviations.
- Forward Hyper-V event channels and host crash dump metadata to a centralized SIEM for cross-host correlation.
- Review virtualization audit policies on multi-tenant or shared Hyper-V environments where untrusted users may control guest VMs.
How to Mitigate CVE-2024-20684
Immediate Actions Required
- Apply the February 2024 Microsoft security updates to all Windows 11 and Windows Server 2022 hosts running the Hyper-V role.
- Inventory all Hyper-V hosts and prioritize patching of systems hosting multi-tenant or untrusted guest workloads.
- Restrict administrative and interactive access on guest VMs to reduce the population of users who could trigger the flaw.
Patch Information
Microsoft addressed CVE-2024-20684 in the February 13, 2024 security updates. Patches are available for Windows 11 21H2, 22H2, and 23H2, as well as Windows Server 2022 and Windows Server 2022 23H2. Consult the Microsoft CVE-2024-20684 Advisory for the specific KB articles applicable to each build.
Workarounds
- No vendor-provided workaround exists. Patching is the supported remediation path.
- Limit guest VM exposure by enforcing least-privilege accounts inside virtual machines until patches are deployed.
- Segregate untrusted or internet-facing workloads onto dedicated Hyper-V hosts to contain the blast radius of a successful denial of service.
# Verify Hyper-V host patch status on Windows Server 2022
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Trigger Windows Update scan and install pending security updates
USOClient.exe StartScan
USOClient.exe StartDownload
USOClient.exe StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
