PoC Released for VMware Workstation Guest-to-Host Escape Vulnerability

NCC Group detailed a VMware Workstation guest-to-host escape achievable from a compromised VM via a logic flaw in virtual device handling that permits memory corruption and controlled code execution on the host process.

The write-up shows a practical exploitation path from guest userland to host compromise, validating real-world risk.

The attack requires execution inside a guest VM but no special guest privileges beyond the ability to send crafted inputs to the VMware backdoor/RPC interface, as reported by NCC Group.

Affected and Impact

The escape allows breaking VM isolation, executing arbitrary code in the host context of the Workstation hypervisor process, and pivoting to the host file system and adjacent VMs.

In multi-VM developer endpoints or sensitive lab environments, this enables data theft and lateral movement.

CVE Table

Field	Details
CVE	Guest-to-host escape in VMware Workstation
Affected Products	VMware Workstation (specific vulnerable versions per NCC Group report)
Component	VMware backdoor/RPC virtual device handling path
CVE IDs	CVE2023-20870/CVE-2023-34044 and CVE-2023-20869

PoC Code

Below is an outline consistent with the NCC Group proof-of-concept description for educational defense and validation in a controlled lab. Use only to test patched status and detections.

• Establish a VMware backdoor/RPC session from guest userland.
• Send two or more RPC packets with the same sessionID, manipulating binary size and payload offset/size to trigger an out-of-bounds write in the host buffer handling routine.
• Achieve overwrite of adjacent host memory to redirect control flow to attacker-controlled data.
• Land a minimal host-side shell payload executed in the Workstation process context.

High-level pseudocode sketch:

// guest-side pseudocode outline

open_vmware_backdoor();

uint32_t sid = rpc_begin_session();

// Packet A: prime host buffer

rpc_send(sid, .bin_size = A_SIZE, .payload_off = OFF_A, .payload_size = SZ_A, .data = bufA);

// Packet B: overlapping write to force OOB and corrupt adjacent metadata/code ptr

rpc_send(sid, .bin_size = B_SIZE, .payload_off = OFF_B, .payload_size = SZ_B, .data = crafted_overlap);

// Optional: Packet C to finalize control-flow hijack

rpc_send(sid, .bin_size = C_SIZE, .payload_off = OFF_C, .payload_size = SZ_C, .data = rop_or_shellcode);

// Trigger vulnerable processing path

rpc_commit(sid);

Key exploitation detail: reuse of the same sessionID with crafted size/offset math causes a buffer boundary miscalculation that performs an out-of-bounds write in the host’s parser, enabling reliable redirection to attacker-controlled code.

Mitigation

• Apply VMware security updates that remediate the vulnerable virtual device/RPC handling path.
• Restrict untrusted workloads in local Workstation; separate high-risk testing VMs from sensitive host data.
• Monitor VMware processes for abnormal child process creation and file access originating from the Workstation host process.
• Enforce host EDR and application control to constrain the hypervisor process behavior post-exploitation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.