Abstract

VMware is a leading and widely used virtualization product. From a security perspective, it is one of the most challenging targets, alongside Hyper-V and KVM. This complexity inspired me to explore this targets further.

My research journey into VMware Workstation began in 2022. After extensively exploring its architecture, I discovered a new attack surface: the Virtual Bluetooth Device. By default, VMware Workstation guests can communicate with other Bluetooth devices through its Virtual Bluetooth Device. Although VMware has only implemented basic Bluetooth functions, the protocol's complexity increases potential for bugs. This attracts me and I decided to look deeper into this component.

In this talk, I will share my journey of working on the Virtual Bluetooth Device, providing fundamental knowledge about its architecture and focusing on several bugs I discovered. This includes two exploitations I successfully demonstrated at Pwn2Own Vancouver in 2023 and 2024. I will discuss the root causes, exploitation methods, and mitigation bypass techniques.