VMware ESXi XHCI USB Controller Heap Overflow Vulnerability

VMware ESXi contains a heap overflow vulnerability in the XHCI USB controller that allows a guest virtual machine to execute code on the ESXi host. This vulnerability can be exploited by an attacker with local administrative privileges on a virtual machine to escape from the virtual machine to the hypervisor.

The vulnerability exists in the way the XHCI USB controller handles certain USB requests from guest virtual machines. A specially crafted series of USB requests can trigger a heap overflow condition, potentially allowing arbitrary code execution on the ESXi host with root privileges.

This vulnerability is particularly severe as it allows for virtual machine escape, which breaks the fundamental security boundary between virtual machines and the hypervisor.