CVE-2018-8218: Input Validation
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects host servers running the Microsoft Hyper-V Network Switch on Windows 10 or Windows Server 2016. Exploitation originates from a guest operating system hosted by the affected server.
What access does an attacker need to trigger the denial of service?
An attacker needs privileged-user access on a guest operating system and must be able to send crafted input to the Hyper-V Network Switch. The CVSS vector indicates the attack can be performed over the network without user interaction once that privilege requirement is met.
What is the impact on the affected host?
Successful exploitation can cause a denial of service affecting the host server. The provided CVSS data indicates no confidentiality or integrity impact, but a high availability impact and a changed scope.
What should administrators do?
Apply the available vendor patch for the affected Windows 10 or Windows Server 2016 systems running Hyper-V. The supplied data does not identify a configuration workaround or mitigation for systems that cannot yet be patched.