# CVE-2025-59517 — Windows Hyper-V Storage VSP `storvsp.sys` Improper Access Control

---

## Summary

| **Product** | Microsoft Windows — `storvsp.sys` (Hyper-V Storage VSP / VSMB miniport) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **8.8 (High)** |
| **CVE Title** | Windows Hyper-V Storage VSP Elevation of Privilege Vulnerability |
| **CWE** | CWE-306 (Missing Authentication for Critical Function), CWE-863 (Incorrect Authorization) |
| **Affected Versions** | Windows Server with Hyper-V role (VSMB enabled) |
| **Impact** | VM guest → host EoP — arbitrary file rename/delete in protected host directories |
| **Exploited ITW** | No |
| **Patch Date** | December 2025 Patch Tuesday |
| **Public analysis** | [78 Research Lab — VSMB improper access control](https://blog.78researchlab.com/302db461-3e5b-802e-bce9-fedd5d683ec3) |

---

## Root Cause

This CVE is a sibling to CVE-2025-59516 in the same VSMB miniport
(`storvsp.sys`), but targets **file manipulation** rather than file creation.
Two functions lack caller authentication:

- **`VspVsmbFileCreate`** — re-used here to obtain a handle without auth.
- **`VspVsmbHandleSetInformationFileRequest`** — handles
  `ZwSetInformationFile` (rename, delete, etc.) from the guest.

The attack chain:

1. `VspVsmbFileCreate` opens a file on the host **without checking caller
   credentials**.
2. `ObDuplicateObject` duplicates the resulting handle into the **SYSTEM
   context**.
3. `ZwSetInformationFile` is called with the duplicated handle to perform
   `FileRenameInformation` or `FileDispositionInformation` (delete) on files
   in **protected host directories** that the guest should not access.

### The patch (verified in ghidriff diff, 5074 → 7171)

The diff shows one key function changed:

- **`VspVsmbFileIoctlVstorVsmbOpenFileValidate`** (83% match) — removed the
  `Feature_2561731899__private_IsEnabledDeviceUsageNoInline` feature-gate checks
  and replaced them with **strict bounds validation** on the request buffer.
  The post-patch code validates every field offset and size against the request
  length before processing, preventing the auth bypass that enabled arbitrary
  file rename/delete.

- **`VspIsValidSgRequest`** (61% match) — hardened scatter-gather request
  validation.

Diff: `ghidriff/CVE-2025-59517/output/storvsp-10.0.26100.5074.sys-storvsp-10.0.26100.7171.sys.ghidriff.md`

---

## Reaching the bug — VM guest call flow

Reachable from **inside any guest VM** via VSMB IOCTL:

```
Guest VM process
    │
    ▼
DeviceIoControl(\Device\STORVSP\VSMB, IOCTL 0x240330, ...)
    │
    ▼
storvsp!VspVsmbFileCreate
    │   No caller auth check
    ▼
storvsp!VspVsmbHandleSetInformationFileRequest
    │
    ├──► ObDuplicateObject(handle, SYSTEM process)
    │
    ▼
ZwSetInformationFile(FileRenameInformation)   ← rename host file
ZwSetInformationFile(FileDispositionInformation) ← delete host file
```

| Element | Value |
|---|---|
| Device path | `\Device\STORVSP\VSMB` |
| IOCTL | `0x240330` |
| Vulnerable functions | `storvsp!VspVsmbFileCreate`, `storvsp!VspVsmbHandleSetInformationFileRequest` |
| Privileges | VM guest user (no host credentials required) |
| SKU | Server with Hyper-V role (VSMB enabled) |

---

## Detection engineering

- **Hyper-V VMBus telemetry**: Monitor for VSMB IOCTL `0x240330` operations
  from guest VMs, especially `FileRenameInformation` or `FileDispositionInformation`
  targeting host paths.
- **Host ETW**: `Microsoft-Windows-Hyper-V-Storage` provider logging abnormal
  `SetInformationFile` operations on VSMB handles.
- **Behavioral tell**: Guest VM renaming or deleting files outside its assigned
  share path is anomalous.

## References

- [MSRC — CVE-2025-59517](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59517)
- [78 Research Lab — VSMB improper access control](https://blog.78researchlab.com/302db461-3e5b-802e-bce9-fedd5d683ec3)