프로젝트
GitHub에서 보기 awesome-vm-escape
winmin/awesome-vm-escape
winmin/awesome-vm-escape has 621 GitHub stars and 79 forks. Star changes are not measured yet. Last checked 2026-11-14 13:28 UTC. Last push 2026-03-18.
측정된 스타 증가
- in 24h
- 기록 수집 중
- in 7 days
- 기록 수집 중
- in 15 days
- 기록 수집 중
- in 1 month
- 기록 수집 중
서로 겹치는 기간의 순증가량이며 일별 합계가 아닙니다. 측정값이 없으면 비워 둡니다. 스타는 관심도를 나타내며 품질을 보장하지 않습니다.
소개
share some useful archives about vm and qemu escape exploit.
학습README.md
Originalawesome-vm-escape 
A curated collection of writeups, exploits, and resources related to virtual machine escape and container breakout.
Contributions are welcome — feel free to open an issue or pull request.
In computer security, virtual machine escape is the process of breaking out of a virtual machine and interacting with the host operating system.
Table of Contents
VMware / ESXi / Fusion
- VMware Escape Exploit - CVE-2017-4901
- 利用一个堆溢出漏洞实现 VMware 逃逸 - CVE-2017-4901
- A Bunch of Red Pills: VMware Escapes (Keen Lab)
- The Great Escapes of VMware: A Retrospective Case Study of G2H Escape Vulnerabilities (Black Hat EU 2017)
- VMware Exploitation - Resource List
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- CVE-2022-31705: GeekPwn 2022 VMware EHCI OOB
- Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor (Black Hat USA 2024)
- On the Clock: Escaping VMware Workstation at Pwn2Own Berlin 2025 - PVSCSI Heap Overflow (Synacktiv)
- The Great VM Escape - ESXicape: CVE-2025-22224/22225/22226 Exploit Chain (Huntress)
VirtualBox
Background
Writeup and Exploit
- VirtualBox E1000 Guest-to-Host Escape
- Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
- VirtualBox 5.2.6.r120293 - VM Escape
- Thinking Outside the VirtualBox - Pwn2Own 2018 漏洞分析
- Escaping VirtualBox 6.1
- Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 - VGA & TPM OOB (Pwn2Own 2023)
- CVE-2024-21115: An Oracle VirtualBox LPE Used to Win Pwn2Own (ZDI)
QEMU
- VM Escape - QEMU Case Study (Phrack)
- QEMU Escape Analysis - CVE-2015-7504 and CVE-2015-7512
- QEMU Escape Exploits Collection
- CVE-2020-14364 QEMU 逃逸漏洞分析
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- Resurrecting Zombies: DMA Reentrancy in QEMU (HITB 2023)
- From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow (OtterSec) | Exploit
Parallels Desktop
- Advanced Exploitation of Simple Bugs - A Parallels Desktop Case Study (Pwn2Own 2021)
- CVE-2023-27326: Parallels Desktop Toolgate Vulnerability
Hyper-V
- Awesome Hyper-V Exploitation - Resource List
- CVE-2023-36427: Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2025-21333: Hyper-V NT Kernel Integration VSP Heap Overflow - SYSTEM Privilege Escalation
- CVE-2025-48822: Hyper-V DDA (Discrete Device Assignment) OOB Read - Local Code Execution
Docker / Container
Background
- Vulnerability Exploitation in Docker Container Environments (Black Hat EU 2015)
- Docker Escape Technology (CanSecWest 2016)
Writeup and Exploit
- Docker 容器逃逸案例分析
- Escaping Docker Container Using waitid - CVE-2017-5123
- Leaky Vessels: CVE-2024-21626 runc Container Breakout (Snyk) | Wiz Deep Dive | Static Detector
- runc Container Breakout via Mount Race Conditions - CVE-2025-31133/52565/52881 (CNCF) | Sysdig Analysis | runc Advisory
- NVIDIAScape: CVE-2025-23266 Three-Line Container Escape in NVIDIA Container Toolkit (Wiz)
- NVIDIA Container Toolkit CVE-2024-0132 Container Escape Deep Dive (Wiz)
Tools
Xen
CTFs
- RealWorld CTF - state-of-the-art_vm
- HITB 2017 - babyqemu
- 0CTF 2017 - QEMU Escape
- 48 小时逃逸 VirtualBox 虚拟机 - 记一次 CTF 中的 0day 之旅
- RWCTF 3rd - BoxEscape (VirtualBox 6.1)