The Microsoft HyperV RemoteFX vGPU enabled on the remote host is affected by multiple vulnerabilities, including the following:

  - An exploitable code execution vulnerability exists in the Shader functionality. An attacker can provide a     specially crafted shader file to trigger this vulnerability, resulting in code execution. This     vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the     vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability     could be also triggered from web browser (using webGL and webassembly). (CVE-2020-6103, CVE-2020-6102)

  - An exploitable code execution vulnerability exists in the Shader functionality. An attacker can provide a     specially crafted shader file to trigger this vulnerability, resulting in code execution. This     vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the     vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability     could be also triggered from web browser (using webGL and webassembly). (CVE-2020-6101)

  - Remote code execution vulnerabilities exist when Hyper-V RemoteFX vGPU on a host server fails to properly     validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote     Code Execution Vulnerability'. (CVE-2020-1032, CVE-2020-1036, CVE-2020-1040, CVE-2020-1041, CVE-2020-1043,     CVE-2020-1043)

Note that Nessus has not tested for this issue but has instead relied only on the application's presence on the machine.

Detections

Analytics

Microsoft Windows HyperV RemoteFX vGPU Multiple Vulnerabilities

critical Nessus Plugin ID 162570

Version 1.6

Version 1.5

Version 1.4

Version 1.6 Oct 6, 2023, 5:06 PM STIG Severity (set to "I") IAVM reference Plugin Feed: 202310061706
Version 1.5 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.4 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046