Microsoft Windows up to Server 2019 Hyper-V input validation

Summaryinfo

A vulnerability was found in Microsoft Windows. It has been classified as problematic. This affects an unknown part of the component Hyper-V. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2019-1399. The attack can only be initiated within the local network. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System). It has been rated as problematic. This issue affects an unknown code block of the component Hyper-V. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. The summary by CVE is:

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0712, CVE-2019-1309, CVE-2019-1310.

The weakness was disclosed 11/12/2019 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The public release has been coordinated in cooperation with Microsoft. The identification of this vulnerability is CVE-2019-1399. Access to the local network is required for this attack. The requirement for exploitation is a simple authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/11/2024). The advisory points out:

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries VDB-145371, VDB-145370, VDB-145369 and VDB-145366 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• 8.1
• 10 1607
• 10 1803
• 10 1903
• Server 1803
• Server 1903
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion