On July 14, 2015 Microsoft released a Critical Hotfix for Hyper-V Servers. The details are a bit vague right now, but it seems that if a Guest has elevated rights with the right tools they can gain access to the Host’s Parent Partition. For obvious reasons this isn’t good and as such all Hyper-V Farms should be patched immediately. It appears that there are two issues: #1 – Hyper-V Buffer Overflow Vulnerability –CVE-2015-2361 A remote code execution vulnerability exists in Windows Hyper-V in a host context if an authenticated and privileged user on a guest virtual machine hosted by Hyper-V runs a specially crafted application. To exploit this vulnerability, an attacker must have valid logon credentials for a guest virtual machine. Systems where Windows Hyper-V is installed are primarily at risk. The security update addresses the vulnerability by correcting how Hyper-V handles packet size memory initialization in guest virtual machines. Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was originally issued Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.   #2 – Hyper-V System Data Structure Vulnerability – CVE-2015-2362 A remote code execution vulnerability exists in Windows Hyper-V in a host context if an authenticated and privileged user on a guest virtual machine hosted by Hyper-V runs a specially crafted application. To exploit...

I was doing some work on my home network this weekend, and in the process joined my Hyper-V hosts to a new domain. My demo laptop, which had about 20 VMs saved, threw an error when I attempted to start them, stating that Hyper-V could not find a useable certificate. To resolve this, I launched the Microsoft Management Console, clicked File -> Add/Remove Snap-in… and double-clicked Certificates. In the Certificates snap-in window, where it asks for the account to manage certificates for, choose the Service account radio button and click Next. Select the Local Computer radio button, click Next and select Hyper-V Virtual Machine Management as the Service account to manage, and click Finish and then OK in the Add/Remove Snap-Ins window. In the Console1 window, expand Certificates – Service (Hyper-V Virtual Machine Management) on Local Computer, then vmms\Personal, and click on the Certificates node. In the results (middle) pane, you will see a certificate(s) for your previous hostname/domain name. Delete these. Launch Services.msc, and restart any running services that start with Hyper-V. Now, back in the Microsoft Management Console, hitting F5 will refresh the screen and show your new valid certificate. You’re now free to go back to Hyper-V Manager and start your VMs.   É  ...