A Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities

on YouTube ↗56m

" summary

Patch diffing of VMware Workstation and Fusion reveals concrete exploit primitives across three surfaces: vmtoolsd.dll RPC send is abused via crafted RPC packets to cause heap OOB reads/writes (session reuse yields a 100‑byte overwrite) and to leak vmx vtable addresses to bypass ASLR; the virtual printer parses crafted EMF with JPEG2000 payloads (≈40 distinct crashes) reaching wprint_proxy.exe; and GPU handling accepts guest shader bytecode injection that triggers memcpy/parse OOBs. Python ctypes, named‑pipe triggers, and a kernel‑driver shim produce POCs that crash hosts and reproduce past host‑escape exploits; vendors add bounds checks in patches.

AI-written summary · about

" chapters (38)

1. 0:00Intro
2. 2:03Why VMWare Patch Analysis?
3. 4:41VMWare Workstation Attack Surfaces
4. 5:08VM-Tools & VMWare RPC
5. 6:02Guest RPC Mechanism
6. 6:46VM Backdoor
7. 8:48RPC Packet Handling in Host
8. 9:36Sending Custom RPC Packets From Guest to Host
9. 10:22RPC Bug 1: OOB in Drag and Drop
10. 11:24Achieving OOB Read
11. 12:02Achieving OOB Write
12. 13:14Info. Leak Using OOB Write Over RPC
13. 15:53Bug 3: Use After Free
14. 18:42VMware Virtual Printer
15. 21:11Triggering the Print Preview
16. 24:38Double Free in EMR_SMALLTEXTOUTW (CVE-2016-7082)
17. 26:34Patch for CVE-2016-7082
18. 28:31Embedded EMFSPOOL (CVE-2016-7083)
19. 30:49Out of Bounds Write Vulnerability in JPEG2000 Decompression (CVE-2016-7084)
20. 33:08Patch for CVE-2016-7084
21. 33:18More Fuzzing
22. 34:57VMware SVGA II Device Architecture
23. 36:09SVGA FIFO Commands
24. 36:23History of Security Bugs in FIFO Commands: Cloudburst by Kostya Kortchinsky
25. 38:07What Are Shaders?
26. 39:14Life of a Shader
27. 40:03Shader inside VMware Workstation
28. 41:12Passing Shader bytecode from guest to host via 'SVGA3D' Protocol
29. 42:44Shader Bytecode handling in Host
30. 43:28Vulnerabilities in Virtual GPU
31. 43:45SVGA Patch 1(Workstation 12.5.4 - 12.5.5)
32. 44:21Heap OOB Write
33. 46:28Demo: SVGA Memory Corruption
34. 47:08Other SVGA Issues fixed in 12.5.5
35. 47:45Possible Security Issue fixed in SM1 'op_calli instruction parser in version 12.5.3?
36. 49:44Black Hat Sound Bytes
37. 50:55Other Works and Recommended Reads
38. 51:09Questions?

" related talks

• 44mFor the Greater Good: Leveraging VMware's RPC Interface for fun and profitJasiel Spelman · CODE BLUE 2017
• 48mStraight Outta VMware: Modern Exploitation of the SVGA Device for Guest-to-Host EscapesZisis Sialveras · Black Hat Europe 2018
• 55mLessons Learned from Eight Years of Breaking HypervisorsRafal Wojtczuk · Black Hat Europe 2014
• 54mPoacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking HypervisorsRafal Wojtczuk · Black Hat USA 2014
• 27m3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio DeviceZhijian Shao, Matthew Shao, Jian Weng, Yue Zhang · Black Hat Asia 2020
• 50mExploiting the Hyper-V IDE Emulator to Escape the Virtual MachineJoe Bialek · Black Hat USA 2019
• 53mXenpwn: Breaking Paravirtualized DevicesFelix Wilhelm · Black Hat USA 2016
• 22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVMGaoning Pan, Chunming Wu, Qiuhao Li, Hui He · Black Hat Asia 2022