Workstation (Windows and Linux) and Fusion (macOS) are VMware's hosted hypervisors: each VM runs as a vmware-vmx process in the user's session, emulating the same devices as ESXi. A guest escape here corrupts that process and then runs on the user's host. Because the device-emulation and GuestRPC code is shared with ESXi, the escape surface is the same, SVGA 3D, USB, NICs, and the backdoor/VMCI channels, and the desktop integration features (shared folders via HGFS, drag-and-drop, and copy-paste) add a prominent, frequently vulnerable surface specific to how these products bridge guest and host.
# from the guest: same emulated devices as ESXi
lspci -nn; lsusb
# host side: the per-VM process is vmware-vmx (Windows) / vmware-vmx (macOS/Linux)
Subtopics#
- Guest-to-host escape: breaking out of a VM to the user's host.
- Shared folder and drag-drop abuse: the HGFS and clipboard integration surface.
- Known escape exploits: the recurring desktop escape bugs.