Researcher Details Hyper-V Use-After-Free Bug and $200,000 Bounty

Summary

Leo Adrien explains how he reproduced a Hyper-V VMBus use-after-free that crashed the host, reported it to Microsoft and received a bounty. Microsoft classified the issue as remote code execution.

Key points

• An initial storage fuzzing experiment unexpectedly triggered a host crash in the VMBus packet-processing stack.
• A malformed packet could be freed without being removed from a linked list, causing a use-after-free during subsequent iteration.
• Adrien reproduced the crash by coordinating valid and malformed packets with a separate worker thread to affect the lookaside-list cache.
• The researcher found no obvious route to code execution, but said Microsoft classified the issue as remote code execution and credited him on an existing CVE.
• The reported fix avoided freeing the malformed packet at the problematic point.
• The talk highlights how custom allocators and multithreading can obscure memory-safety bugs during testing.