CVE-2020-1040
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Description
CVE-2020-1040 is a critical-severity improper input validation vulnerability in Microsoft Hyper-V RemoteFX vGPU. The host server fails to properly validate input from an authenticated user on a guest operating system, allowing an attacker to achieve remote code execution on the host operating system. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 0.18% (39.3rd percentile), the exploitation probability is relatively low, but the critical severity and guest-to-host escape capability make it a high-priority patching target.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://nvidia.custhelp.com/app/answers/detail/a_id/5044(Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1040(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1040(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when software does not validate or incorrectly validates input that can affect the control flow or data flow of a program. In the case of Microsoft Hyper-V RemoteFX vGPU, the host server fails to properly validate input received from authenticated users on guest operating systems, enabling remote code execution on the host.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2020-1040 carries a CVSS 3.1 score of 9.0 (CRITICAL), reflecting a severe threat to virtualization environments. The vulnerability is exploitable from an adjacent network with low attack complexity and requires only low-level authentication, with no user interaction needed. Confidentiality (High): An attacker can access sensitive data on the Hyper-V host, potentially including other virtual machines' data. Integrity (High): Successful exploitation allows arbitrary code execution on the host, enabling full system modification. Availability (High): The attacker can disrupt the host operating system and all hosted virtual machines. The scope is changed, meaning exploitation from a guest VM can impact the host and other guests, significantly amplifying the blast radius of an attack.
Exploit Maturity
CVE-2020-1040 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.18% (39.3rd percentile) suggests that while broad exploitation is not yet widespread, targeted attacks against Hyper-V environments are occurring. No public exploit code or proof-of-concept was identified in the available references. This vulnerability is part of a family of related Hyper-V RemoteFX vGPU flaws (CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043), which may be chained together for broader impact.
Remediation
- Apply vendor security updates immediately as required by the CISA KEV directive: Apply updates per vendor instructions. The remediation deadline was 2022-05-03.
- Update all affected Microsoft Windows Server installations — Windows Server 2008 R2, Windows Server 2012 (including R2), and Windows Server 2016 — to the latest cumulative security patches.
- If immediate patching is not feasible, consider disabling the RemoteFX vGPU feature on affected Hyper-V hosts to eliminate the attack surface until patches can be applied.
- Implement network segmentation to isolate Hyper-V management interfaces and limit adjacent network access to trusted systems only.
- Monitor Hyper-V host event logs for unusual activity originating from guest operating systems, including unexpected process execution and privilege escalation attempts.
Technical Details
CVE-2020-1040 is rooted in an improper input validation flaw (CWE-20) within the Hyper-V RemoteFX vGPU component. The vulnerability arises because the host server does not adequately validate data received from authenticated users on guest operating systems when processing RemoteFX vGPU requests. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that the attack requires adjacent network access, meaning the attacker must have a presence on the same network segment or within a guest VM. With low attack complexity and low privileges required, an authenticated guest OS user can craft malicious input that escapes the guest boundary and executes arbitrary code in the context of the host operating system, achieving a guest-to-host escape.
Frequently Asked Questions
Is CVE-2020-1040 being actively exploited?
Yes. CVE-2020-1040 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 0.18% indicates exploitation is targeted rather than widespread, but organizations running Hyper-V with RemoteFX vGPU should prioritize remediation.
What products are affected by CVE-2020-1040?
CVE-2020-1040 affects Microsoft Windows Server 2008 R2, Windows Server 2012 (including R2), and Windows Server 2016 running Hyper-V with RemoteFX vGPU enabled. The vulnerability specifically targets the RemoteFX vGPU component used for GPU virtualization.
How do I fix CVE-2020-1040?
Apply the security updates provided by Microsoft for all affected Windows Server versions. If patching is not immediately possible, disable the RemoteFX vGPU feature on Hyper-V hosts and restrict adjacent network access to management interfaces.
How severe is CVE-2020-1040?
CVE-2020-1040 has a CVSS 3.1 score of 9.0 (CRITICAL). The vulnerability allows guest-to-host escape with full compromise of confidentiality, integrity, and availability, making it one of the most severe types of virtualization vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.