Abstract

As one of the most widely used hypervisors, the significance of a complete VMware escape is becoming increasingly prominent. However, the proliferation of memory protection mechanisms in modern mainstream operating systems, such as heap allocation randomization, has made achieving stable virtual machine escapes progressively challenging. Typically, successful exploitation usually requires a combination of information leakage and memory corruption vulnerabilities, making it difficult to exploit a single vulnerability, like heap overflow write vulnerability.

In order to solve the above challenges, this talk will introduce two common exploit techniques. One is a common exploit technique that demonstrates how to achieve full guest-to-host escape exploitation using only a heap overflow write vulnerability in VMware, which makes a hard-to-exploit vulnerability exploitable. The other is common exploitation technique that enhances the stability of heap exploitation across most hypervisor by leveraging the Host Virtual Address.

So, first, we will introduce a double fetch vulnerability we discovered in USB devices, which allows for limited heap overflow writes. We will demonstrate how to transform a heap overflow write primitive into a heap overflow read primitive to obtain an information leak and achieve stable control flow hijacking in VMware Fusion with default configurations.

Remarkably, we will demonstrate a full guest-to-host escape on VMware Fusion for both Intel and M1 chips running macOS. The two types of chips exhibit slight differences in getting Host Virtual Address.