PoC exploit Released for VMware Workstation guest-to-host escape Vulnerability
A proof-of-concept (PoC) exploit has been released for a critical vulnerability in VMware Workstation, enabling an attacker to escape from a guest virtual machine and execute arbitrary code on the host operating system.
A proof-of-concept (PoC) exploit has been released for a critical vulnerability in VMware Workstation, enabling an attacker to escape from a guest virtual machine and execute arbitrary code on the host operating system.
The exploit combines an information leak and a stack-based buffer overflow vulnerability to achieve a full guest-to-host escape, which is among the most severe types of security flaws in virtualization software.
The vulnerabilities targeted by the exploit were first demonstrated at the Pwn2Own Vancouver event in 2023. Security researcher Alexander Zaviyalov of NCC Group provided a detailed technical analysis along with a functional PoC to showcase the risks posed by these flaws.
The guest-to-host escape exploits two distinct vulnerabilities within the virtual Bluetooth device functionality of VMware Workstation. This feature, enabled by default, lets a guest VM utilize the host's Bluetooth adapter.
Information Leak (CVE-2023-20870, CVE-2023-34044): The initial stage leverages a Use-After-Free (UAF) memory leak. By sending specially crafted USB Request Block (URB) control transfers to the virtual mouse and Bluetooth devices, an attacker can leak memory pointers from the vmware-vmx.exe process on the host. This information leak is crucial for bypassing Address Space Layout Randomization (ASLR), a standard security measure that randomizes memory locations to hinder exploitation.
Buffer Overflow (CVE-2023-20869): With ASLR bypassed, the attacker triggers a stack-based buffer overflow by sending a malicious Service Discovery Protocol (SDP) packet from the guest VM to another Bluetooth device discoverable by the host. This overflow allows the attacker to hijack the execution flow and execute a custom payload on the host system.
The vulnerabilities targeted by the exploit were first demonstrated at the Pwn2Own Vancouver event in 2023.
The combined vulnerabilities enable an attacker with control over a guest VM to gain full control of the host machine. In a demonstration, the exploit successfully launched a reverse shell from a Linux guest to a fully patched Windows 11 host, effectively compromising the system.
The exploit primarily impacts VMware Workstation version 17.0.1 and earlier. The vulnerabilities have been addressed as follows:
The stack-based buffer overflow ( CVE-2023-20869 ) was fixed in version 17.0.2. The memory leak vulnerabilities ( CVE-2023-20870 and CVE-2023-34044 ) were patched in versions 17.0.2 and 17.5.0, respectively.
Users operating on version 17.0.1 or older remain at the highest risk due to the necessity of both vulnerabilities for the full exploit chain.
Users are advised to update VMware Workstation to the latest version (17.5.0 or newer) to ensure protection against these vulnerabilities.
For users unable to update immediately, disabling the virtual Bluetooth device is a potential workaround. This can be done by unchecking the "Share Bluetooth devices with the virtual machine" option in the VM's USB Controller settings, thereby removing the attack surface exploited by this specific PoC.
These findings highlight the complexity of modern exploits and underscore the importance of timely updates for virtualization platforms.
Based on reporting by Cyber Security News.