cbcvebase.
CVE-2024-21407
published 2024-03-12

CVE-2024-21407: Windows Hyper-V Remote Code Execution Vulnerability

PriorityP185high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
16.38%
96.6th percentile
Windows Hyper-V Remote Code Execution Vulnerability

Affected

41 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2052610.0.10240.20526
microsoftwindows_10_1607< 10.0.14393.679610.0.14393.6796
microsoftwindows_10_1809< 10.0.17763.557610.0.17763.5576
microsoftwindows_10_21h2< 10.0.19044.417010.0.19044.4170
microsoftwindows_10_22h2< 10.0.19045.417010.0.19045.4170
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2052610.0.10240.20526
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.679610.0.14393.6796
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.557610.0.17763.5576
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.417010.0.19044.4170
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.417010.0.19045.4170
microsoftwindows_11_21h2< 10.0.22000.283610.0.22000.2836
microsoftwindows_11_22h2< 10.0.22621.329610.0.22621.3296
microsoftwindows_11_23h2< 10.0.22631.329610.0.22631.3296
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.283610.0.22000.2836
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.329610.0.22621.3296
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.329610.0.22631.3296
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.329610.0.22631.3296
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.247686.2.9200.24768
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.218716.3.9600.21871
microsoftwindows_server_2016< 10.0.14393.679610.0.14393.6796
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.679610.0.14393.6796
microsoftwindows_server_2019< 10.0.17763.557610.0.17763.5576
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.557610.0.17763.5576
microsoftwindows_server_2022< 10.0.20348.233310.0.20348.2333

Detection & IOCsextracted from sources · hover to see the quote

snort
63140, 63141, 63142, 63144, 63145, 63152, 63153, 63155, 63156, 63161, 63162, 63169, 63170
snort
300855, 300856, 300858, 300859, 300860
  • Attacker must be authenticated inside a guest VM and send specially crafted file operation requests to hardware resources on the VM to achieve RCE on the host server — monitor for anomalous VM-to-host hardware resource requests.
  • Exploitation requires prior reconnaissance of the target environment; detect unusual information-gathering activity from within guest VMs before any exploit attempt.
  • The attack vector is guest-to-host: monitor authenticated sessions on Hyper-V guest VMs for unexpected or malformed file operation requests directed at VM hardware resources.
  • ·Exploitation is rated 'Less Likely' by Microsoft and requires high attack complexity, including pre-exploitation reconnaissance and authenticated access to a guest VM — not a trivial attack chain.
  • ·Talos notes that additional Snort rules may be released at a future date and current rules are subject to change pending additional information.

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
vendor_msrc8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.