CVE-2024-38080: Windows Hyper-V Privilege Escalation

CVE-2024-38080 Overview

CVE-2024-38080 is an elevation of privilege vulnerability in the Windows Hyper-V hypervisor. The flaw is rooted in an integer overflow or wraparound condition [CWE-190] that allows an authenticated local attacker inside a guest virtual machine to gain SYSTEM-level privileges on the host. Microsoft addressed the vulnerability in the July 2024 Patch Tuesday release. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-38080 to its Known Exploited Vulnerabilities (KEV) catalog after confirming in-the-wild exploitation. The vulnerability affects Windows 11 and Windows Server 2022 systems running the Hyper-V role.

Critical Impact
A successful exploit allows a low-privileged attacker in a Hyper-V guest to escape isolation boundaries and execute code at SYSTEM on the host, breaking the security model that separates tenants on shared virtualization infrastructure.

Affected Products

Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2022
Microsoft Windows Server 2022 23H2

Discovery Timeline

2024-07-09 - Microsoft releases security patch as part of July 2024 Patch Tuesday
2024-07-09 - CVE-2024-38080 published to NVD
2024-07-09 - CISA adds CVE-2024-38080 to the Known Exploited Vulnerabilities catalog
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2024-38080

Vulnerability Analysis

The vulnerability resides in the Windows Hyper-V virtualization stack. Hyper-V provides hardware-assisted isolation between guest virtual machines and the host operating system through the hypervisor and the Virtual Machine Worker Process (vmwp.exe). An integer overflow condition [CWE-190] in this code path allows an attacker operating inside a guest VM to corrupt host-side state. Successful exploitation results in code execution within the host kernel context, granting full SYSTEM privileges. The Common Weakness Enumeration classifies this as an integer overflow leading to memory corruption.

The attack vector is local, but "local" in the Hyper-V threat model includes any code running inside a guest virtual machine. This expands the attack surface to any tenant or workload on a multi-tenant Hyper-V host. The Exploit Prediction Scoring System (EPSS) places this vulnerability in the 94th percentile, reflecting the active exploitation observed by CISA.

Root Cause

The root cause is an integer overflow in arithmetic performed on size or index values within the Hyper-V hypervisor or supporting kernel components. When the calculated value wraps around, subsequent memory operations use an undersized or attacker-controlled length, leading to out-of-bounds memory access on the host. Microsoft has not released the exact code path publicly. Refer to the Microsoft Security Response Center advisory for vendor-supplied technical detail.

Attack Vector

An attacker requires authenticated access with low privileges inside a Hyper-V guest virtual machine. From the guest, the attacker issues crafted hypercalls or device I/O requests that trigger the overflow in host-side code. No user interaction on the host is required. The vulnerability enables a complete VM escape, breaking the security boundary between guest and host. See the CISA Known Exploited Vulnerabilities entry for confirmation of active exploitation.

Detection Methods for CVE-2024-38080

Indicators of Compromise

Unexpected crashes or restarts of the vmwp.exe Virtual Machine Worker Process on Hyper-V hosts
Hyper-V-Worker event log entries showing abnormal guest-to-host transitions or hypercall failures
New SYSTEM-level processes spawned on the host shortly after activity in a guest VM
Unsigned or anomalous kernel module loads on patched Hyper-V hosts

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-Hyper-V-Worker and Microsoft-Windows-Hyper-V-Hypervisor for repeated faults or partition errors
Correlate guest VM behavior with host-side process creation events using EDR telemetry
Baseline normal hypercall frequency and alert on statistical anomalies originating from individual guests
Hunt for privilege escalation chains where activity in a guest VM is followed by SYSTEM-context actions on the host

Monitoring Recommendations

Forward Hyper-V operational logs and Sysmon process creation events to a centralized SIEM for cross-host correlation
Track patch compliance for KB articles associated with the July 2024 cumulative update across all Hyper-V hosts
Alert on creation of new local administrator accounts or scheduled tasks on Hyper-V hosts following guest activity
Enable kernel-level driver load logging and review for unsigned or recently introduced drivers on virtualization hosts

How to Mitigate CVE-2024-38080

Immediate Actions Required

Apply the July 2024 Microsoft security updates to all Windows 11 and Windows Server 2022 systems running the Hyper-V role
Prioritize patching for multi-tenant Hyper-V hosts and any host running untrusted guest workloads
Audit which guests have privileged users and treat those guests as elevated risk until hosts are patched
Review CISA KEV remediation deadlines and validate compliance for federal and regulated environments

Patch Information

Microsoft published the fix through the July 2024 Patch Tuesday cumulative updates. Administrators should consult the Microsoft Update Guide for CVE-2024-38080 for the specific KB articles corresponding to each affected Windows build. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or your configured patch management system. Reboot hosts to complete installation of hypervisor-level patches.

Workarounds

No official workaround exists; Microsoft recommends installing the security update as the only complete remediation
Restrict administrative access within guest VMs to trusted personnel until patches are applied
Isolate unpatched Hyper-V hosts from running untrusted or low-trust guest workloads
Consider temporary suspension of nested virtualization features on unpatched hosts where operationally feasible

bash

# Verify Hyper-V host patch level on Windows Server 2022
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2024-07-09') } | Sort-Object InstalledOn

# Confirm Hyper-V role status
Get-WindowsFeature -Name Hyper-V | Select-Object Name, InstallState

# Audit running virtual machines and their guest OS versions
Get-VM | Select-Object Name, State, Version, Generation