Yeah, it's definitely a possibility but only if the host of the VM is having a security vulnerability and also left configured improperly.
A good example of this, is if you run backtrack in a VM and then ping the VM's IP from your PC you can reach it.
VMs can have different types of links to a router. It can be:
- Physical (Another Ethernet Card or USB Wifi)
- Bridged to Host (Connect via the host)
- Replicating Host Connection
Depending on the exact type, the method may change but fundamentally the VM to access the internet has to be on your LAN. Now regardless whether it's on the router directly LAN or an interval LAN between the host and the VM, it still can ping you and you can ping it in normal communication.
So unless the host has a good firewall, etc that blocks these kind of connections, it can be hacked into through the VM via this common network interface in theory. Obviously, it's not very practical in terms of amount of effort to use the VM as a pivot point to find and then exploit in the host but it can be done.
- Have a firewall to monitor inter-VM traffic, etc. Don't use the same
- Internet connection on the VM, using a separate say USB Internet Modem would keep you on different networks.
In a nut shell: VMs are mostly contained and secure on their own, but it is you who connects the host and the VM on a common network, i/o device, etc. Don't do that and you'll be practically quite safe.
A good potential option is remove all non-critical components sharing from the VM and use shell access to run the VM. Chances that a program can bypass the memory limit or so is not likely, not likely at all.
Point is, anything programmable can be hacked given enough time and effort.