CVE-2021-27242
📋 TL;DR
This vulnerability in Parallels Desktop allows local attackers with initial low-privileged access to a guest virtual machine to escalate privileges and execute arbitrary code in the hypervisor context. The flaw exists in the Toolgate component due to improper validation of user-supplied data leading to memory corruption. Only Parallels Desktop installations are affected.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host system through hypervisor escape, allowing attacker to execute arbitrary code with hypervisor privileges and potentially access all VMs and host resources.
Likely Case
Privilege escalation from guest VM user to hypervisor-level access, enabling lateral movement to other VMs and host system compromise.
If Mitigated
Limited to guest VM isolation breach if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Requires existing low-privileged access to guest VM. ZDI advisory suggests exploit is reliable. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Desktop 16.1.0 or later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install update to version 16.1.0 or later. 4. Restart Parallels Desktop and affected VMs.
🔧 Temporary Workarounds
Disable Toolgate component
macosTemporarily disable the vulnerable Toolgate component to prevent exploitation
Not available - requires configuration changes in Parallels Desktop settings
Restrict guest VM network access
allIsolate vulnerable guest VMs from sensitive networks and other VMs
Configure VM network settings to use isolated or NAT-only networking
🧯 If You Can't Patch
- Isolate affected VMs on separate network segments with strict firewall rules
- Implement strict access controls and monitoring for guest VM user activities
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: Open Parallels Desktop > About Parallels Desktop. If version is 16.0.1-48919 or earlier, system is vulnerable.Check Version:
Not applicable - check via GUI in About Parallels DesktopVerify Fix Applied:
Verify version is 16.1.0 or later in About Parallels Desktop dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual Toolgate component activity
- Guest VM processes attempting hypervisor calls
- Privilege escalation attempts from guest VMs
Network Indicators:
- Guest VM making unexpected network connections to host or other VMs post-exploitation
SIEM Query:
Not applicable - host-based monitoring required