ESXi emulates USB host controllers (UHCI, EHCI, XHCI) in the vmx process. They process the guest's transfer descriptors and transfer rings, and the emulated USB devices handle guest requests. Flaws in the controller or device handling corrupt memory in the host-side process, a recurring secondary escape surface after graphics.

USB escape surface:
- Host controllers: UHCI, EHCI, XHCI (transfer ring / descriptor parsing)
- Emulated USB device models

Exploitation notes#

• The XHCI controller has the richest command and transfer-ring surface and has produced escapes.
• Reachability requires a USB controller on the guest, which is common; the device code is shared with Workstation and Fusion.
• The handling runs in the vmx process, then escalates to the host.

References#

• Zero Day Initiative: VMware research
• VMware security advisories