Each ESXi VM runs a vmx process on the host that emulates its virtual hardware. Every emulated device parses guest-controlled input, so a memory-corruption flaw runs code in the vmx process, which is then escalated to the host. The surface splits by device, and because the same device code is shared with Workstation and Fusion, escapes often affect all three.
Subtopics#
- SVGA and 3D graphics: the classic ESXi escape surface.
- USB controllers: UHCI, EHCI, and XHCI emulation.
- Virtual NICs: the vmxnet3 and e1000 adapters.
- Backdoor and VMCI: the guest-to-vmx control channels.