ESXi's virtual network adapters process the guest's transmit and receive descriptor rings in the vmx process. The paravirtualized vmxnet3 adapter is the common default and a notable escape surface, and the emulated e1000 is also present. Crafted descriptors or offload parameters trigger memory corruption in the host-side process.

Virtual-NIC escape surface:
- vmxnet3: TX/RX queues, descriptor and offload handling
- e1000: descriptor rings and segmentation offload

Exploitation notes#

• vmxnet3 is the default high-performance adapter, so it is widely present; its descriptor handling is the reachable surface.
• The adapter processing runs in the vmx process, then escalates to the host.
• The same adapter code is shared with Workstation and Fusion.

References#

• Zero Day Initiative: VMware research
• VMware security advisories