The guest-to-host escapes published against Workstation and Fusion, many from Pwn2Own, fall into the same clusters as ESXi plus the integration handlers that the desktop products expose more prominently:
- Drag-and-drop and copy-paste (DnD/CP): use-after-free and out-of-bounds bugs in the transfer-object handling have been a repeated desktop escape vector.
- Shared folders (HGFS): path handling and request parsing bugs, giving host file access or code execution.
- SVGA 3D graphics: the shared surface/shader/command path, as on ESXi.
- USB controllers: descriptor and ring handling in the shared USB models.
- vmxnet3 and e1000: shared NIC ring and descriptor handling.
Using the pattern#
# fingerprint the product and build
vmware -v 2>/dev/null
# which integration features and devices are enabled (the reachable surface)?
mount | grep -i hgfs # shared folders active
lspci -nn | grep -iE 'svga|vmxnet|usb' # device models present
# enabled DnD/CP and 3D are set in the VM .vmx settings
Match the product build to the advisory for the component, favouring the DnD/CP and HGFS handlers on desktop targets where those features are enabled, since they are the surface most specific to Workstation and Fusion. The device-model bugs overlap ESXi, so an ESXi SVGA/USB/NIC escape frequently indicates the same issue here.
Exploitation notes#
- The integration handlers (DnD/CP, HGFS) are the desktop-specific hot spot; they are enabled far more often on desktop VMs than on servers, so prioritise them when those features are on.
- Shared device bugs (SVGA, USB, NIC) are common to ESXi; see ESXi known escape exploits for the same clusters.
- Escapes are build-specific and generally need an info leak plus the corruption primitive; the mechanisms are on the per-surface pages.