Privilege escalation via mount.vmhgfs and vmware-user-suid-wrapper suid utilities.
vulners.com/securityvulns/securityvulns:doc:26509