# Blind OS Command Injection via Activation Request

Uninitialized heap read and stack overflow in VMware Workstation's virtual Bluetooth USB device let a guest OS attacker leak memory and execute code on the hypervisor.

- Payout: $80,000
- Severity: high
- Program: VMware
- Credited: Nguyễn Hoàng Thạch
- Disclosed: 2023-05-18
- CVE: CVE-2023-20869, CVE-2023-20870
- Write-up quality: 8/10
- Original: https://www.zerodayinitiative.com/blog/2023/5/17/cve-2023-2086920870-exploiting-vmware-workstation-at-pwn2own-vancouver
- Library page: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-5-17-cve-2023-2086920870-exploiting-vmware-workstation-at-pwn2own-vancouver
- Tags: domain:desktop impact:privesc impact:rce kind:bounty platform:blog sev:high tech:windows technique:chained technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** vmware-vmx.exe virtual Bluetooth USB device (VUsbBluetooth URB handling and SDP PDU parser)
**Root cause:** VUsbBluetooth_OpSubmitUrb sets urb_actualsize from attacker-controlled total_urb_len before validating the request opcode, so an invalid bRequest leaves the size unset and returns uninitialized heap data. SDPData_ReadElement passes a guest-controlled size descriptor to SDPData_ReadRawInt, overflowing a stack buffer.
**Steps:**
1. Enable 'Share Bluetooth devices with the virtual machine' (default) so the guest sees the VBluetooth USB device.
2. For the info leak: send a URB to the VBluetooth device with an invalid bRequest opcode and a large total_urb_len; urb_actualsize stays attacker-controlled and UHCI_UrbResponse returns that many bytes of uninitialized urb_data heap.
3. For the overflow: open an L2CAP connection to L2CAP_SIGNALLING_CID with PSM 0x1 to create an SDP socket.
4. Send an SDP PDU whose data element size descriptor is oversized; SDPData_ReadElement passes it to SDPData_ReadRawInt, overflowing the stack buffer.
5. Chain the leak to defeat ASLR, then use the overflow to hijack control flow and execute code in vmware-vmx.exe on the host.
**How found:** Code review of vmware-vmx.exe: noticed RBuf_New uses malloc (uninitialized) and that urb_actualsize is assigned from guest-controlled total_urb_len before opcode validation, leaving it unset on invalid bRequest; separately traced SDP PDU parsing where the size descriptor flows unchecked into SDPData_ReadRawInt.
**Exploitation:** Attacker with high-privileged code in the guest OS uses the uninitialized-variable leak to disclose heap memory and defeat ASLR, then triggers the SDP stack buffer overflow to gain code execution in the hypervisor context, spawning calc on the host at Pwn2Own.
**Escalation:** Guest-to-host escape by chaining the info leak (CVE-2023-20870) with the stack overflow (CVE-2023-20869).
**Insight:** In USB/emulated-device handlers, check whether the response length field is set before or after request validation—an early assignment from a guest-controlled length plus an uninitialized malloc buffer yields an info leak. Also audit protocol size descriptors that index fixed stack buffers.