CVE-2025-47982

storvsp.sys -- improper input validation allows elevation of privilege from Hyper-V guest

Summary

Field	Value
Driver	`storvsp.sys` (Hyper-V Storage Virtual Service Provider)
Vulnerability Class	Improper Input Validation
CVSS	7.8
Exploited ITW	No
Patch Date	July 8, 2025

Root Cause

The Hyper-V Storage Virtual Service Provider (storvsp.sys) mediates storage requests between guest VMs and the host's physical storage stack. It sits on the host side of the VMBus, translating guest storage operations into host-level I/O. This position makes it a trust boundary: everything arriving from the guest side should be treated as untrusted input.

The vulnerability exists because storvsp.sys accepts certain fields from guest storage requests without adequate validation. When a guest VM sends a crafted storage request with malformed parameters, the driver processes those values at face value. The missing validation leads to kernel memory corruption on the host, turning a guest-level operation into a host-level privilege escalation.

ZeroPath published an analysis showing how the validation gap manifests during the processing of virtual SCSI request blocks. The specific fields that lack validation are size and offset parameters that the driver uses to index into host-side buffer allocations.

Exploitation

An attacker operating within a Hyper-V guest VM crafts storage requests with parameters designed to trigger the validation gap. When the host-side storvsp.sys driver processes these requests, the unchecked values cause writes to kernel memory at attacker-influenced offsets.

The attack is notable because it crosses the VM isolation boundary. The attacker starts inside a guest with no special host privileges and achieves kernel memory corruption on the host. Combined with standard heap grooming on the host side, this can be escalated to full SYSTEM-level execution on the Hyper-V host.

Exploitation Primitive

Crafted guest storage request -> storvsp.sys validation gap
  -> host kernel memory corruption at attacker-controlled offset
  -> SYSTEM on Hyper-V host

Broader Significance

Guest-to-host escapes through the storage VSP are particularly impactful in multi-tenant cloud environments where Hyper-V provides the isolation boundary between tenants. A vulnerability in storvsp.sys means that a compromised guest VM could potentially affect the host and, by extension, other guests on the same physical machine. This is one of several Hyper-V VSP vulnerabilities patched in the July 2025 cycle, suggesting that Microsoft is actively auditing this attack surface.