An ESXi virtual machine runs under a per-VM vmx user-space process on the host that emulates the VM's devices, backed by the vmkernel hypervisor. A guest escapes by making vmx mishandle data the guest controls, so the target is the device-emulation code: the SVGA graphics device with its 3D command stream, the emulated USB controllers, the virtual network adapters, and the backdoor and VMCI control channels. Each reads guest-supplied structures (command FIFOs, transfer descriptors, ring buffers, RPC messages) in the host process, and a memory-safety flaw there yields code execution in vmx, which runs with enough privilege to reach the host.
The escape surface a guest can reach from inside:
# enumerate the emulated hardware the VM exposes (from a Linux guest)
lspci -nn # SVGA II, vmxnet3/e1000, USB (UHCI/EHCI/XHCI), VMCI
lsusb; ls /sys/bus/pci/devices # USB controllers and PCI functions
dmesg | grep -iE 'vmwgfx|vmxnet|vmw_vmci' # loaded VMware guest drivers
Subtopics#
- Backdoor and VMCI: the control channels into the vmx process.
- SVGA and 3D graphics: the graphics device command stream.
- USB controllers: emulated UHCI, EHCI, and XHCI.
- Virtual NICs: the e1000 and vmxnet3 network adapters.