Breaking Theoretical Limits: The Gap Between Virtual NICs and Physical Network Cards
summary
Code review of netvsp.ko and Hyper‑V VM switch logic reveals a practical method to craft guest packets that bypass link‑layer length checks by using VM bus mapping and hooking the guest send routine. Demonstrations include a 69741‑byte ICMPv6 that exceeds the 65535 RFC limit and a 15‑byte IPv4 packet that triggers out‑of‑bounds reads; the work links to MS advisories (C 2021 24074 and C 2022 1223) and shows a working host crash/information‑leak proof‑of‑concept.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:07Understanding virtual network interface cards
- 5:09Hyper-V network module findings
- 14:29Oversized packets vulnerability
- 20:21Long Point vulnerability demo
- 22:43Summary
related talks
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
20mNetKernel: Making Network Stack Part of the Virtualized Infrastructure
27mImplementing SR-IOV Failover for Windows Guests During Migration
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
55mLessons Learned from Eight Years of Breaking Hypervisors
31mA Practical, Research‑Backed Introduction To Cloud‑Native Kernel‑Bypass Networking
54mPoacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors
51mSoftware Defined Networking Using the VXLAN Standard