Loading vulnerability…
CVE-2021-28476 is a remote code execution vulnerability in Microsoft Windows Hyper-V. The flaw allows an attacker to execute arbitrary code on the host system by sending specially crafted requests to the Hyper-V service. The vulnerability is due to improper validation of input in the Hyper-V implementation, which can lead to memory corruption and code execution with elevated privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a proof-of-concept (PoC) exploit for CVE-2021-28476, a guest-to-host remote code execution vulnerability in Microsoft Hyper-V (specifically in vmswitch.sys). The exploit is implemented as a set of patches to the Linux Hyper-V network driver (hv_netvsc), with the main logic in 'src/netvsc_drv.c' and 'src/rndis_filter.c'. The PoC works by building a custom Linux kernel module with the provided patches, loading it in a guest VM, and then triggering the vulnerability by changing the MAC address of the network interface. This causes the guest to send a malicious RNDIS packet over VMBus to the host, which leads to a crash (BSOD) on the Hyper-V host, demonstrating the impact of the vulnerability. The repository is structured with a README explaining the vulnerability and usage, a diff file for the patch, and the full source code for the modified driver files. No hardcoded network endpoints or IPs are present; the exploit targets the virtualized communication channel (VMBus) between guest and host. The exploit is a proof-of-concept and does not provide a weaponized or automated payload, but demonstrates the vulnerability's impact.
This repository provides a proof-of-concept (POC) exploit for CVE-2021-28476, a set of vulnerabilities in Microsoft Hyper-V's vmswitch (WPP code) when handling set OID requests. The repository contains two files: a README.md describing the vulnerabilities and a poc.patch file. The patch adds several 'trigger' functions to the Linux Hyper-V network driver (rndis_filter.c), which craft and send malicious OID set requests to the Hyper-V host. These requests can cause the host to dereference attacker-controlled pointers or perform out-of-bounds reads, as described in the advisory. The exploit is not a standalone script but a kernel patch that must be applied and built into the Linux guest kernel. The attack vector is local, requiring code execution within a Hyper-V guest VM. The only fingerprintable endpoint is the patched kernel source file. No network endpoints or external IPs/domains are present. The exploit is a POC and does not provide a weaponized payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.