微软^(Microsoft)发布了一个安全更新——KB4571756——由于存在安全漏洞，它将禁用RemoteFX vGPU 功能。^{(RemoteFX vGPU)}它适用于Windows 10 版本 2004^{(Windows 10, version 2004)}和所有版本的Windows Server版本 2004。

发布此更新后，任何启用了 RemoteFX vGPU 的 VM 都将失败并显示以下错误消息：

• 无法启动虚拟机，因为在Hyper-V 管理器^{(Hyper-V Manager)}中禁用了所有支持 RemoteFX 的GPU^(GPUs)。
• 虚拟机无法启动，因为服务器GPU资源不足。

即使最终用户尝试重新启用RemoteFX vGPU，VM 也会显示错误消息——

We no longer support the RemoteFX 3D video adapter. If you are still using this adapter, you may become vulnerable to security risk.

什么是 RemoteFX vGPU 功能？

运行虚拟机时，RemoteFX v GPU功能允许您共享物理GPU。当物理GPU^(GPU)资源过多时，该功能非常适合，但相反，所有VM^(VMs)都可以动态共享GPU以用于其工作负载。优点当然是降低了GPU的成本并减少了CPU负载。如果你想像一下，这就像在同一个物理GPU上同时运行多个DirectX应用程序。因此，与其购买 4 个GPU^(GPUs)，不如购买一个GPU可能会有所帮助，具体取决于工作量。它还附带了限制物理GPU过度使用的对策。

RemoteFX vGPU周围的安全漏洞是什么？

RemoteFX vGPU 是旧的。它是在Windows 7中引入的，现在面临远程代码执行漏洞。当主机服务器上的Hyper-V RemoteFX^{(Hyper-V RemoteFX)} vGPU 无法正确验证来宾操作系统上经过身份验证的用户的输入时，存在远程执行代码漏洞。当攻击者在来宾操作系统上运行精心设计的应用程序时，主机服务器上的Hyper-V RemoteFX vGPU 无法正确验证来自来宾操作系统上经过身份验证的用户的输入，从而攻击在^{(Hyper-V RemoteFX)}Hyper^(Hyper-V)上运行的单个第三方视频驱动程序，就会发生这种情况-V主机。

一旦攻击者获得访问权限，他就可以在主机操作系统上运行任何代码。由于这是一个架构问题，因此没有解决方法。

RemoteFX vGPU 的替代品

唯一的选择是使用备用 vGPU，它可能来自第三方应用程序或Microsoft建议使用离散设备分配^{(Discrete Device Assignment)}( DDA )。它允许您将整个PCIe 设备^{(PCIe Device)}集成到一个虚拟机中。您不仅可以允许访问图形^(Graphics)车，还可以共享NVMe存储。

DDA的最大优势除了它的安全性之外，在将设备安装到 VM 中之前无需在主机上安装驱动程序。只要 VM 可以识别设备的PCIe Location，就可以确定 VM的Path来挂载它。^(Path)简而言之，将GPU传递给 VM 的DDA允许在 VM 和所有功能中使用本机GPU驱动程序。^(GPU)这包括DirectX 12、CUDA等，这在^(CUDA)RemoteFX v GPU中是不可能的。

如何重新启用 RemoteFX vGPU

Microsoft明确警告您不应使用RemoteFX vGPU，但如果必须，有一种方法可以再次启用它，风险自负。

假设您已配置RemoteFX vGPU 3D 适配器，以下是仅适用于Windows 10版本 1803 和更早版本的详细信息

使用Hyper-V 管理器^{(Hyper-V Manager)}配置RemoteFX vGPU

要使用Hyper-V Manager配置^{(Hyper-V Manager)}RemoteFX vGPU 3D ，请执行以下步骤：

• 停止虚拟机
• 打开Hyper-V 管理器^{(Hyper-V Manager)}并导航到 VM Settings。
• 单击添加硬件。
• 选择 RemoteFX 3D图形适配器^{(Graphics Adapter)}，然后选择 添加^(Add)。

使用PowerShell^(PowerShell) cmdlet配置RemoteFX vGPU

• Enable-VMRemoteFXPhysicalVideoAdapter
• 添加-VMRemoteFx3dVideoAdapter
• 获取 VMRemoteFx3dVideoAdapter
• 设置-VMRemoteFx3dVideoAdapter
• 获取 VMRemoteFXPhysicalVideoAdapter

您可以在 Microsoft 上阅读有关它的更多信息。^{(about it here on Microsoft.)}

Windows 10 disables support for RemoteFX vGPU; Can you re-enable it?

Microsoft has released a security update—KB4571756—which wіll disable the RemoteFX vGPU feature because of a security vulnerability. It applies to Windows 10, version 2004, and all editions Windows Server version 2004.

Post this update, any VM that has RemoteFX vGPU enabled will fail with the following error messages:

• The virtual machine cannot be started because all the RemoteFX-capable GPUs are disabled in Hyper-V Manager.
• The virtual machine cannot be started because the server has insufficient GPU resources.

Even if the end-user tries to re-enable the RemoteFX vGPU, the VM will display the error message—

We no longer support the RemoteFX 3D video adapter. If you are still using this adapter, you may become vulnerable to security risk.

What is the RemoteFX vGPU feature?

When running Virtual Machines, the RemoteFX vGPU feature lets you share the physical GPU. The feature fits well when physical GPU is too much of a resource, but instead, all VMs can dynamically share the GPU for their workload. The advantage is, of course, the reduction in the cost of GPU and decreasing CPU load. If you want to imagine, it is like running multiple DirectX applications at the same time on the same physical GPU.  So instead of buying 4 GPUs, one GPU could help, depending on the workload. It also came with countermeasures that restricted the overuse of physical GPU.

What is the security vulnerability around RemoteFX vGPU?

RemoteFX vGPU is old. It was introduced in Windows 7 and is now facing a remote code execution vulnerability. A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. It happens when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system when an attacker runs a crafted application on a guest OS, which attacks individual third-party video drivers running on the Hyper-V host.

Once the attacker has access, he can run any code on the host OS. Since this is an architectural issue, there is no fix for it.

Alternatives to RemoteFX vGPU

The only option is to use an alternate vGPU, which could be from third-party applications or Microsoft suggests using Discrete Device Assignment (DDA). It allows you to entire PCIe Device into a VM. Not only can you allow access to Graphics cars, but you can also share NVMe storage.

The biggest advantage of DDA apart from that it’s secure, there is no need to install drivers on the host before the device being mounted within the VM. As long as VM can identify the device’s PCIe Location, the Path can be determined for the VM to mount it. In short, DDA passing a GPU to a VM allows the native GPU driver to be used within the VM and all capabilities. That includes DirectX 12, CUDA, etc., which was not possible with RemoteFX vGPU.

How to re-enable RemoteFX vGPU

Microsoft clearly warns that you should not be using the RemoteFX vGPU, but if you have to, there is a way to enable it again at your own risk.

Assuming you have already configured the RemoteFX vGPU 3D adapter, here are the details that will work only on Windows 10, version 1803, and earlier versions

Configure RemoteFX vGPU with Hyper-V Manager

To configure the RemoteFX vGPU 3D by using Hyper-V Manager, follow these steps:

• Stop the Virtual Machine
• Open Hyper-V Manager and navigate to VM Settings.
• Click on Add Hardware.
• Select RemoteFX 3D Graphics Adapter, and then select Add.

Configure RemoteFX vGPU with PowerShell cmdlets

• Enable-VMRemoteFXPhysicalVideoAdapter
• Add-VMRemoteFx3dVideoAdapter
• Get-VMRemoteFx3dVideoAdapter
• Set-VMRemoteFx3dVideoAdapter
• Get-VMRemoteFXPhysicalVideoAdapter

You can read more about it here on Microsoft.

Related posts

• 如何使用和添加Work/School帐户到Microsoft Authenticator app

• 如何禁用可移动存储类和Windows 10访问

• Delete Files Permanently使用免费File Shredder software Windows

• Tiny Security Suite帮助您加密，筛制和保护PC上的文件

• 如何在Windows 10中重置Windows Security app

• 如何在Windows 11/10关闭Security and Maintenance notifications

• 如何保证网站安全：威胁和处理漏洞

• Netcam Studio：Windows的All-in-One surveillance system

• 浏览Experience Security Check：您的浏览器有多安全？

• Restrict USB access至Windows 10计算机，带Ratool

• Security & Privacy Tips中的LinkedIn Login and Sign

• 如何使用Sandboxie上Windows 10

• 什么是SMB Port？什么是Port 445和Port 139用于？

• 如何保护您的WiFi - Know已连接

• 您的IT administrator已禁用Windows Security

• 如何将File type or Process Exclusion添加到Windows Security

• 如何在Windows 10 Taskbar上隐藏或显示Windows Security icon

• Lock desktop图标或Password在Windows保护应用程序 - 桌面

• Rogue Security Software or Scareware：如何检查，防止，删除？

• 如何查找链接到Email address and Phone number的帐户