ESXi Attack Surface and the Original UAF Vulnerability

▶ Watch (01:39)

VMware ESXi runs on a specialized VMkernel instead of a standard host OS, with a fine-grained sandbox controlling each process. The attack surface for guest-to-host escapes sits almost entirely in virtual devices, specifically modules that the guest can trigger without the guest OS interfering. Most pre-2024 critical vulnerabilities were USB-related, hitting the xHCI controller and Bluetooth device.

The 2021 Tianfu Cup vulnerability, found by Qihoo 360, was a use-after-free in the xHCI USB controller. The bug let an attacker modify a slot context before xHCI_clear_stream_context ran, causing the pipe cleanup step to be skipped. The URB and pipe stayed alive after the stream context was freed. Manually clearing the pipe afterward freed those URBs, subtracting a value from an already-freed stream context. That subtraction is the UAF.

The Failed Patch: CVE-2021-22005 Never Fixed

▶ Watch (07:22)

VMware’s 2021 patch changed the execution order in two xHCI command ring handler functions, but it only fixed one code path. Jiang found that xHCI clear string context takes an endpoint ID parameter, so modifying the entire slot and then issuing a disable-slot command clears all endpoint string contexts through the unguarded path.

“We find that the patch never succeed.” — Yuhao Jiang

The same UAF was still fully triggerable. CVE-2021-22005 was reported in 2023 under a new identifier, CVE-2024-22252, and nobody publicly connected the two until this talk.

Exploitation Primitives and VM Escape Chain

▶ Watch (09:28)

The UAF only subtracts from offset +0x205C of the freed chunk. That offset is not 64-bit aligned, so hitting a pointer shifts it 4 GB and crashes. VMware’s xHCI string-context hashmap stores each entry as a 12-byte struct (8-byte pointer + 4-byte ID), placing the subtract on the low four bytes of a real pointer. Controlled bend, useful primitive. Heap overlap via hashmap primitive (13:17) shows GMR and URB positioned so the subtract hits URB’s actual_len, opening out-of-bounds reads and fake string-context forging. Forging the V-USB device object inside a URB then redirects its function pointer to an arbitrary address.

ESXi Sandbox Architecture and CBT Driver Bug

▶ Watch (19:11)

After VM escape, the VMX process still runs inside a sandbox. ESXi has over 100 sandbox domains, each with a syscall access mask. The VMX domain gets a narrow set and cannot escalate to a broader one.

Zumin found that the VMX domain has read/write access to the CBT (Changed Block Tracking) driver. Its update_bitmap function validates the user-supplied offset and size against the file size, not the bitmap. Grow the file after the bitmap is allocated and the bounds check passes while the bitmap stays small. Out-of-bounds write. A three-step chain then leaks a kernel address, zeroes the bitmap pointer, and OR-writes the syscall access mask table: CBT bitmap OOB write triggering sandbox escape (30:26)

End-to-End VM-to-Host Escape Demo

▶ Watch (31:10)

The demo was recorded before Tianfu Cup 2023. A controlled Windows guest running on the ESXi target downloads the exploit payload, executes it, and sets the environment. The payload fetches additional files, runs them, and opens a callback channel. Seconds later, the researchers receive a reverse shell with root privileges on the ESXi host. Full ESXi escape exploit demo (31:10)

Q&A

Has VMware changed their bug bounty program, and how does it compare to other vendors? VMware has not changed their bounty program, and the payout is well below Microsoft’s and Google’s. ▶ 33:10

Do VM escapes require root privileges in the guest? Most VM escapes require guest root because communicating with virtual devices normally needs root, though the speaker allowed there may be some attack surfaces that don’t. ▶ 33:44

Notable Quotes

We find that the patch never succeed. Yuhao Jiang · ▶ 8:28

it shows that even small drivers can be dangerous. Zumin · ▶ 30:54

a vulnerability from 2021 wasn’t truly fixed until 2024. Yuhao Jiang · ▶ 17:41

VMware sponty program is significantly lower than the actual value of these vulnerabilities. Yuhao Jiang · ▶ 17:52

Key Takeaways

  • Verify patches by auditing all triggerable code paths, not just the one originally reported.
  • Even a highly constrained UAF becomes critical when the right heap primitive—like a resizable hashmap—is nearby.
  • Low bug-bounty payouts push researchers toward competitions, extending the window vulnerabilities stay unpatched in the wild.