Public Workstation and Fusion escapes line up with ESXi: the SVGA 3D adapter is the dominant target, with USB controllers and the integration features (HGFS, drag-and-drop) close behind. Pwn2Own regularly produces desktop VMware escapes, and because the vmware-vmx device code is shared, many of them also apply to ESXi.
Recurring desktop VMware escape surfaces:
- SVGA / 3D graphics acceleration (primary)
- USB controllers (UHCI/EHCI/XHCI)
- Shared Folders (HGFS) and drag-and-drop handlers
Exploitation notes#
- Reachability depends on configuration: 3D acceleration, specific USB controllers, and Shared Folders must be enabled on the guest.
- Escapes land on the host desktop as the user running the VM, then escalate; sandbox detonation hosts are a prime target.
- Shared device code means findings port between ESXi and the desktop products in both directions.