Guest-to-host escape

A Workstation or Fusion guest escapes by corrupting the vmware-vmx process that emulates its devices, exactly as on ESXi but landing on the user's desktop host. The same SVGA 3D, USB, NIC, and GuestRPC/VMCI surfaces apply, and code execution in vmware-vmx runs with the privileges of the user or service running the VM.

2분 분량2026년 10월 7일 업데이트florianamette기여자 1명
어시스턴트에게 묻기 (MCP)GitHub에서 편집

On Workstation and Fusion each VM is emulated by a vmware-vmx process in the host user's session, so a guest-to-host escape is the same memory-corruption problem as on ESXi, with the payoff landing on the desktop host. The reachable surfaces are identical because the code is shared: the SVGA II device and its 3D command stream, the emulated USB controllers, the virtual NICs, and the backdoor GuestRPC and VMCI control channels. A memory-safety flaw in any of them gives code execution in vmware-vmx, which runs with the privileges of whoever started the VM.

bash
# the escape surface, enumerated from inside the guest (same as ESXi)
lspci -nn | grep -iE 'svga|vmxnet|usb|vmci'
lsusb; dmesg | grep -iE 'vmwgfx|vmxnet|vmw_vmci'

The per-device mechanisms are documented under the ESXi guest-to-host pages, since the device models are shared:

What differs from ESXi#

bash
# the host is a desktop OS, so post-escape you are in the user's session:
#  - Windows: vmware-vmx.exe runs as the logged-in user (or elevated if the VM was)
#  - macOS/Linux: vmware-vmx runs as the user; Fusion uses a helper for some ops
# privilege after escape = the VM-launching user's, then local privesc on the host

Exploitation notes#

  • The device-model bug classes are shared with ESXi, so the mechanisms and the enumeration are identical; the difference is the landing environment, a desktop user session rather than the vmkernel host.
  • Post-escape privilege equals the user running the VM; a further local privilege escalation on the desktop OS is often needed for full host control, unlike ESXi where vmx is already highly privileged.
  • The integration features (shared folders, drag-and-drop) are more commonly enabled on desktop products than on servers, making the GuestRPC/HGFS surface especially relevant here; see Shared folder and drag-drop abuse.

References#

이전Workstation and Fusion다음 Shared folder and drag-drop abuse