Knock, Knock – Who’s There?

McAfee Labs documents a design flaw in WSL’s Plan 9 (P9) filesystem allowing a local user with the same privileges as a WSL instance to hijack the P9 server: on WSLv1 by taking over the AF_UNIX fsserver socket and on WSLv2 by manipulating vsock/listening ports and a custom kernel module. The writeup includes PoC steps, demonstrates impacts such as file tampering, persistence and security bypass, and provides detection and mitigation recommendations (MVISION/ENS rules, file collectors and EDR monitoring).